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ABSTRACT 

Studies done in the past have drawn on lessons learned 
with regard to human loss-of-life events. However, an 
examination of near-fatal accidents can be equally 
useful, not only in detecting causes, both proximate and 
systemic, but also for determining what factors averted 
disaster, what design decisions and/or operator actions 
prevented catastrophe. 

Binary pass/fail launch history is often used for risk, but 
this also has limitations. A program with a number of 
near misses can look more reliable than a consistently 
healthy program with a single out-of-family failure. 
Augmenting reliability evaluations with this near miss 
data can provide insight and expand on the limitations 
of a strictly pass/fail evaluation. 

This paper intends to show how near-miss lessons 
learned can provide crucial data for any new human 
spaceflight programs that are interested in sending man 
into space. 

1. INTRODUCTION 

Evaluating reliability for forthcoming space programs, 
particularly man-rated systems, is challenging. One 
reason for this is that it is rarified territory. There are 
only three countries to date who have launched humans 
into space, and those flights took place using a limited 
number of launch and space vehicles, largely comprised 
of custom parts. In order to get a sample size large 
enough for a meaningful reliability estimate, 
particularly for a dissimilar vehicle, unmanned launch 
vehicles reliabilities are often used to estimate it. 

But failure criteria for a manned and unmanned vehicle 
are not necessarily the same. A problem that a payload 
could compensate for might not be as readily survivable 
for a craft that must return safety to earth. On the other 
hand, something that would send a payload into a 
useless orbit may be readily survivable for a manned 
vehicle, perhaps even without losing the mission, as 
happened with the Abort to Orbit of STS-51F. Because 
the mission was to test Spacelab systems and perform 


science, the lower orbit was not a hindrance. [1] Under 
these circumstances, an apparent success may actually 
represent catastrophic failure for the new vehicle and a 
previously documented failure may not be catastrophic. 

Additionally, launch risk, while a significant portion of 
the overall risk, is not the only risk for a manned vehicle 
that must spend some set time in space and then return 
safely. For that risk, there is a dearth of data outside of 
previous human spaceflights. Frequently, for ease, 
reliability tends to be focused on launch, using pass/ fail, 
because that’s where the most data is. However, the 
focus on the launch failures can be misleading 
especially when one notes that three out of four 
spaceflights that involved catastrophic results (and 
several that ended successfully) involved either failures 
that occurred after launch or manifested during other 
stages, particularly reentry. 

Complex craft, with many goals and many factors, do 
not lend themselves well to binary pass/fail criteria, or 
rather, using that pass/ fail criteria can skew the results 
depending on what aspects one is evaluating. The intent 
of this paper is to provide examples of useful aspects of 
near miss or catastrophic failures to demonstrate the 
value of examining these failures in detail. By using that 
data to drive requirements and designs for future human 
spaceflight programs, more robust and safer designs can 
be worked, using lessons learned the hard way. This 
data can also add depth and refinement to the limited 
data available for estimating reliability for unproven 
hardware. 

Because failures are not limited to manned spaceflight 
systems, the term “human” will often be used to indicate 
the human/safety implications. Human spaceflight and 
manned spaceflight are used interchangeably in this 
paper. 

2. LAUNCH 

2.1. Launch Lessons Learned - From Failures 

The best aspect of studying launches for safety concerns 
is the quantity of data available. Anything going into 



space is subject to a well documented launch. Manned 
and unmanned launches are prone to many of the same 
issues and, in some cases, use the same hardware. 
Because of this, a new space program can use 
considerable history to evaluate a launch system. Solid 
and liquid rockets, both cryogenic and otherwise, have 
all been used for both manned and unmanned flights, 
allowing for a substantial data set for evaluations. 

Ideally, any rocket designer would examine as much 
failure data as possible for lessons learned, particularly 
those rockets using similar (or even identical hardware), 
but that review should also encompass key launch 
systems, like avionics, separation, and software. 

One of the two lessons readily learned going through 
past launch failures (regardless of rocket type) is that 
even proven hardware and/or software can fail when 
used in new applications or new configurations. For 
example, Ariane 5 failed during its maiden flight when 
untested heritage software was shown to be a poor 
match for the increased thrust and trajectory of the new, 
more powerful, rocket. [2] Integrated testing of complex 
systems is key to a successful program and shaking out 
incompatibilities before they become deadly. 

Another key lesson, demonstrated unfortunately by the 
Challenger Shuttle disaster involves learning from the 
failures and danger signals of the past. [3] Rather than 
accepting anomalous readings or behavior, a rigorous 
review of even minor anomalies and unexpected results 
can highlight a correctable problem before it becomes 
deadly. Many rockets that eventually failed did so only 
after test anomalies or previous failures were not 
adequately addressed. 

2.2. Launch Lessons Learned - From “Successes” 

Since rocketry took off, there have been more than 4500 
successful launches of significant rockets (as opposed to 
test flights and hobby flights), a tremendous 
accomplishment and source of data, but the data has 
some limitations. For instance, the amount of data 
readily available on a successful rocket flight is 
frequently very limited outside the immediate program. 

Many launches are associated with defense systems or 
proprietary rocketry systems where information, other 
than overall success or failure, is not publicly available. 
With spectacular or expensive failure, sometimes the 
reasons for failure are released to the public. For 


successes, it is exceedingly rare for anomalies or other 
non-catastrophic failures to be advertised at all. This is a 
serious limitation when trying to glean useful 
information from launch successes, though such data 
can be used, if used carefully, for reliability 
calculations. 

Key exceptions to this general trend are previous 
manned systems. Because of the civilian aspect of those 
launches and the international cooperation between 
spacefaring nations, a wealth of information is 
publically available on the manned space programs of 
both Russia (formerly the Soviet Union) and the United 
States. This data is potentially very useful. 

For example, the Apollo 12 rocket was struck by 
lightning during launch. As a result, the crew module’s 
instruments went off line, cutting off telemetry to the 
ground. When telemetry resumed, it was garbled and 
potentially inaccurate. A ground controller figured that 
the signal conditioner had gone off-line and need to be 
reset. The command to do so was obscure, but, Alan 
Bean, the lunar module pilot, remembered it from a 
training incident a year before. This kind of near 
disaster not only serves as a reminder to protect against 
lightning, but demonstrates the importance of 
exhaustive training and exercises that simulate even 
obscure failures. Because of the ground controller’s 
understanding of the systems, he was able to accurately 
diagnose the problem. It is essential that the ground 
controller understand his or her systems. Equally 
important, in this instance, was the knowledge Alan 
Bean had retained from training. Training at NASA for 
flights is exhaustive and this was not the last time it 
saved the situation. [4] [5] [6] 

There was another near miss with STS-61C, where the 
launch was scrubbed due to weather. Unknown to the 
ground and crew, a temperature probe broke loose and 
jammed open a pre -valve, leaking out great quantities of 
liquid oxygen. Although the potential repercussions are 
speculative, there are several scenarios that could have 
led to several unpleasant outcomes, including a 
turbopump overspeed destroying the hydraulic systems 
and/or inability to make it up to orbit. [7] [8] Foreign 
Object Debris (FOD) is a huge risk during launch and 
considerable steps are now taken at NASA to reduce it, 
including screens internal to the fuel and oxygen 
systems. FOD has been implicated in a number of 
unmanned launches as well. 



And the problem was not entirely eliminated. On STS- 
93, a wiring short shut down the primary controllers for 
two out of three engines. The engines switched 
automatically to backup controllers which allowed the 
flight to continue. The Orbiter would have been lost, 
otherwise and the crew would have tried to bail out, a 
risky operation. At the same time, a pin broke free in the 
fuel injector and impacted on the engine bell, cutting 
across hydrogen cooling lines and releasing liquid 
hydrogen. Fuel was exhausted prematurely, but, 
fortunately, was not so severe to seriously impact the 
flight. The Orbiter made a slightly lower orbit 
successfully where the mission (releasing the Chandra 
Observatory) was successfully completed. If the leak 
had been larger, the crew might have been forced to 
make a Return To Launch Site (RTLS) abort, another 
tricky operation that has never been attempted 
before. [4][9][10] In this case, several key design 
philosophies worked in concert to prevent disaster, 
including true and automatic redundancy, that allowed 
the engines to use backup controllers without requiring 
direction. Wiring flaws that allowed propagation of 
failures to multiple components were addressed - the 
Shuttle fleet stood down to work a number of wiring 
issues for several months. Future reusable craft, in 
particular, must be especially cognizant of wiring 
concerns as work in and around wiring can cause 
inadvertent damage. And diligence to eliminate FOD 
must be continuous. 

Of course, Columbia was eventually lost to FOD, [11] 
external to the craft rather than internally - but still 
deadly. Notable near misses where considerable damage 
to the Thermal Protection System (TPS) occurred that, 
under slightly different circumstances, could have led to 
loss during reentry: STS-27R and STS-45, though the 
latter might have been orbital debris[12]. 

2.3. Crew escape 

Abort is a term used for both manned and unmanned 
spacecraft, though the implementation is generally 
different. Abort is intended to save life and minimize 
the impact of a catastrophic failure. In an unmanned 
vehicle, this is done by exploding the launch vehicle to 
minimize downstream damage (no crashing into cities 
and towns). In a manned vehicle, this is done by 
ejecting the crewed element, preferably as far from the 
rest of the launch vehicle as possible. 


Aborts have been used successfully many times to 
minimize damaged from malfunctioning unmanned 
craft, and have even been used to save crew on at least 
two different occasions. In one case (Solyut/Soyuz-18a), 
a second stage separation failure triggered the crew 
escape system. Unfortunately, the abort was launched 
toward earth and landed with very high g-forces (>20 
g). Although the crew survived, the landing was 
dangerous, the landing spot was precarious and it took 
more than a day to rescue the crew. [4] [ 1 3] [ 1 4] 
Commander Lasarev sustained internal injuries and 
never flew again. 

But there were good lessons here. First, that an abort 
system is better than none for launch systems - it’s 
unlikely the crew would have survived at all without it. 
Secondly, that the crew escape system apparently was 
inadequate to this usage; better to have gone up and 
away rather than launching directly to the ground. 
Perhaps attitude sensors could ensure the escape 
parameters are tailored to attitude. 

On Solyut/Soyuz-lOa, a fuel spill caught fire just prior to 
launch. The abort command from ground control failed 
because the control lines had already been burned 
through. As the crew escape capability was not 
automated nor crew commandable, abort was delayed 
until the ground was able to link via radio and command 
the escape system. The escape system activated only 
two seconds before the booster exploded. The crew, 
though badly jolted, survived. [4] [15] 

Both the problems and the final success of this escape 
highlight the importance of options. An all manual 
system is dependent on people being alert (and not 
incapacitated). An automated system is dependent on 
computer and software working as expected or 
situations being within expected parameters. Having the 
option for both, while not without its own risks, leaves 
options open when the unexpected happens. 

Sometimes when a system is not used is also significant. 
When the crew of Gemini 6 should have ejected from 
the spacecraft after an early abort (per procedure), they 
chose not to. Because the launch vehicle had not 
actually lifted off, the crew’s decision turned out to be a 
good one. But a factor in that decision was a lack of 
confidence in the escape system. [4] [16] A safety system 
that is unreliable, unproven or is perceived as such by 
the crew may not be any better than nothing at all. If the 
crew doesn’t realize its limitations, they might not 



pursue an alternative with a better chance of success. If 
it’s perceived as unreliable, the crew is unlikely to use it 
until it’s too late. 

3. ON-ORBIT FAILURES 

Once we look beyond launch failures, the data is largely 
limited to manned programs. Such things as tin whisker 
failures on satellites[ 1 7] and orbital debris impacts on 
orbiting crafts[18] are pertinent to manned systems, but 
the former can be addressed with proper material 
controls and due diligence. The latter is a considerable 
problem too large to be addressed within this paper. 
However, many of the failures on-orbit that are of 
interest are related to stations and manned orbiting 
spacecraft. There are a number that provide salutary 
lessons for future manned space programs. 

For instance, several flights struggled with temperature 
control, including Vostok 4, Vostok 5[19] and Apollo 
13 (which was only one of its issues)[4]. Although it 
seems a minor concern, temperature control is key not 
only for the crew’s comfort but for equipment. Low 
temperatures and condensation put electronics at risk. 
Too warm, and components can readily overheat. 
Thermal control is a non-trivial issue as temperatures 
can vary drastically in space from less than a hundred 
degrees below zero (°C) to more than a hundred degrees 
above zero (°C). Power consumption of nominal 
equipment can add appreciably to the heat burden. 
Thermal control often involves a combination of 
systems, both air and liquid cooling, but steps need to be 
taken to ensure they work in concert, and that a problem 
with one can be compensated for in the other. 

Attitude control/guidance is another type of failure that 
endangered missions and crew. On Gemini 8, a failed- 
on thruster caused an uncontrolled spin. Believing it 
was associated with the docked Agena spacecraft, the 
crew module was undocked, which resulted in even 
faster spinning with the mass of Agena no longer 
slowing it down. Close to unconsciousness from the g- 
forces from the 1 rev/s rotations, the crew managed to 
gain control by turning off the automatic systems and 
using the reentry systems for control. Although the 
mission ended early as a result, the crew were able to 
return safely. NASA adopted provisions that can isolate 
faulty thrusters. [20] 

Inadvertently turning on the wrong guidance system 
during Apollo 10 caused another uncontrolled spin that 


was only corrected by shutting down the system back 
off and flying manually. A crash was narrowly 
averted. [21] 

Apollo 13 was a spectacular example of what can go 
wrong (due to a design change that wasn’t carried 
forward to all the affected systems) and how excess 
capability in other systems can be utilized when things 
go wrong. That margin saved lives, although it was 
challenging and uncomfortable. Among the other 
lessons learned were the advantages of like interfaces 
for similar systems (such as LiOH canisters - a lesson 
that has served the Shuttle, extravehicular (EVA) 
systems and the ISS well) and the importance of 
knowledgeable systems experts on the ground to help 
find solutions to challenging problems. [4] [22] [23] [24] 

And there are many more on-orbit near misses that 
provide lessons. For any program contemplating having 
EVA, the Apollo Lunar Surface Journals provide 
incomparable data about setting foot on other planetary 
surfaces. [25] Walking on Olympus: An EVA Chronology’ 
is also an excellent resource for EVA data. [26] 

4. REENTRY/LANDING FAILURES 

Our “safe reentry” history is almost entirely restricted to 
manned spacecraft again. Despite the risks of launch, 
three of four catastrophic in-flight events have involved 
reentry. It is an unforgiving phase of flight, subject to 
several extremes including heat and acceleration. 

The first catastrophic event involved Soyuz 1, where 
Cosmonaut Komarov lost his life when his main chute 
failed to open. Komarov tried to manually deploy his 
reserve chute, but the reserve became tangled with the 
drogue chute which had deployed but not released. 
Retrorockets also failed to fire. The results were 
devastating. The rush to space drove unsustainable 
schedules, and Soyuz was launched with several known 
problems and more suspected. [27] Schedule pressure is 
a common theme for many of the most devastating 
space accidents. 

Another painful in-flight failure also involved reentry, 
in this case, a breathing ventilation valve that was jolted 
open during separation on Soyuz 11, venting the 
internal atmosphere. The pyros for separation, rather 
than firing as planned (sequentially), fired 
simultaneously, causing damage to the valve. The 
descent module’s atmosphere vented in about 30 



seconds and, though the crew recognized what was 
happening, they did not have sufficient time to shut off 
the valve before they were incapacitated. The crew were 
lost. [28] The awkward location of the valve shut-off 
(and the time required to complete shut-off) were 
factors in this failure as was the lack of suits for the 
crew or emergency oxygen for the crew. 

In the case of Columbia, on STS- 107, the failure was 
tied to breach of the TPS, damaged during launch, 
which protects the rest of the craft from reentry heating. 
Hot plasma impinged on wing structure, wiring and 
eventually hydraulics that led to a catastrophic yaw that 
caused a break-up during reentry. There were no 
survivors. There was considerable history of foam 
impacts to the Orbiter, but no provisions for detecting or 
repairing catastrophic damage on orbit. Although, with 
the limited launch data, there was evidence of a 
significant hit, ground controllers were lulled into 
complacency by the very history of previous impacts 
into assuming the damage was sustainable. Details on 
this are discussed in depth in the Columbia Accident 
Investigation Report(s). [29] [30] 

The catastrophic failures provide only part of the 
available data for a new program. A number of other 
survived failures highlight what could fail and what 
provisions prevented tragedy for reentry/landing. 
Vostok 1, for instance, failed to separate completely 
from its service module until the wires between the 
reentry capsule and the service module were burned 
through during reentry, affording the first man in space, 
Gugarin, a very rough ride. Because of the design of the 
capsule, the reentry vehicle righted itself during reentry 
so that the heat shield took the heating. [31] This same 
failure (or a similar one involving a restraining strap), 
has recurred multiple times on Soviet/Russian reentry 
vehicles, including Vostok 2, [32] Vostok 5, [33] 
Voshkod 2, [34] and Soyuz-5,[35][36]. The design of the 
descent module, the designed-to-burn wires connecting 
the descent and service modules, the titanium airlock, 
and the thermal protection system have made these 
failures survivable. However, in several cases, these 
failures led to rough reentries, overheating, toxic fumes 
internal to the module, landing far from the original 
planned target, and very hard landings. In some cases, 
the original failure, failure of the modules to separate 
completely, was compounded by descent systems not 
working or retrorockets failing to fire. Sometimes, it 
was the cause. [34][35] 


Landing outside the expected zone was another 
common problem for capsules. A combination of factors 
(distraction, overwork and a malfunction in the 
automatic alignment system) contributed to Mercury 7 
missing its reentry mark such that it landed 400 km 
from target. [4] [3 7] Separation issues drove Voshkod 2 
and Soyuz 5 off the mark. Voshkod 2 was stranded in 
the woods overnight before rescuers could retrieve 
them.[35] With Soyuz 5, Cosmonaut Volynov walked to 
a nearby peasant’s house given he knew it would be 
some time before he’d be rescued, despite the fact his 
hard landing had broken his teeth.[36] Soyuz 23 
performed an emergency landing after an aborted 
docking (due to electronics failure) but landed in a 
frozen lake at -20 °C. They could not be retrieved until 
the next day, where they, amazingly, were found 
alive. [3 8] Although the capsule landing system allowed 
for flexibility in the target, missing the target was not 
without risks. These landings were survivable because 
of resilient designs that allowed for delayed retrieval. 

On the last Apollo mission, Apollo-Soyuz, a crew error 
left the reaction control system on during reentry, 
allowing toxic fumes to enter the crew module through 
relief valves used for equalization. The challenges of the 
toxic atmosphere were compounded with a harder than 
normal landing. Fortunately, the crew did have oxygen 
masks available. An inhibit scheme that precludes 
incompatible flight modes (reaction control during times 
when equalization valves are open) could have 
prevented this failure. [3 9] 

5. GROUND SAFETY 

In addition to protecting the safety of the crew during 
flight, considerable effort needs to be taken to protect 
those on the ground. The most obvious concern, of 
course, is spectacular launch failure or explosion. Early 
in the space race (October 1960), there was a horrific 
fire during preparations for a ballistic missile launch. 
Schedule pressure induced the man in charge, Marshal 
Nedelin, to have people work fuel leak and electrical 
problems while the rocket was still loaded with fuel. 
While work continued on the rocket, Nedelin and many 
dignitaries were brought close to look over the craft. A 
critical safety device was left in the wrong position, 
energizing the systems. When the safety device was 
reset, the last safeguard was removed. The resulting 
explosion cost Marshall Nedelin and many other people 
their lives. [39][40] 



The risk of fire during launch is still very much alive. 
Two Long March launches went awry in 1995 and 1996 
resulted in crash landings seconds after launch, with a 
considerable death toll each time. [41] In 2003, Brazil’s 
space program took a considerable step backwards with 
a launchpad ignition of one of the solid rocket boosters, 
killing twenty and destroying the launch pad. [42] 
Underfunding, a breakdown in training, safety 
procedures and routine maintenance were all cited as 
contributors to the Brazilian tragedy as was an electrical 
fault. [43] 

There are other potentials for catastrophic fire that can 
affect ground personnel and crewmembers. The Apollo 
1 fire provides an excellent example of the risks of off- 
gassing of materials and the flammability risks of high 
pressure oxygen environments, of insufficient safety 
precautions available during tests. Three crewmembers 
were lost when a spark ignited a fire in the capsule. The 
high internal pressure precluded immediate access to the 
crew. A number of material and electrical issues were 
identified as potential contributors, made worse by high 
pressure. [44][45] Similarities between this fire and one 
that took the life of Cosmonaut Bondarenko in 1961 
during a test make this failure particularly poignant. 
Crewmembers, like the first man in space, Cosmonaut 
Yuri Gagarin (1967), and astronauts Clifton Williams 
(1967) or Robert Henry Lawrence (also 1967) and 
Cosmonaut Vosovikov (1993), have all been killed 
during training exercises. Test subjects have been killed 
or nearly killed in vacuum chambers after being 
exposed to vacuum.[47] 

But ground personnel are also at risk. Ground personnel 
have been killed in a Delta engine fire in 1963, have 
fallen from heights in 1964 (Vertical Assembly 
Building), been struck by lightning (1965), and been 
asphyxiated with a nitrogen purge (1981). These failures 
highlight the importance of comprehensive safety 
precautions and training, personal protective equipment 
(such as oxygen monitors), etc. [47] The commercial 
world has already had its first losses as an explosion at a 
Scaled Composite site has killed three people and 
injured several more in 2007. [48] We must be diligent. 

6. CONCLUSION 

The failures and near-failures described here are only 
examples of the wealth of data available, information 
that can provide even more important lessons for those 
who would follow in illustrious footsteps or attempt to 


venture beyond where we have been before. There is 
more data available about these failures and many more 
incidents than can be covered in this paper. 

Studying the mistakes we lived throughand those we 
didn’t - allows us to learn what saved us or what failed 
to, where we went wrong and what we did right that 
allowed us to triumph after all. 

There are lessons about design, which are often readily 
absorbed. But there are other more subtle lessons are 
available that are easily lost from program to program, 
like the importance of comprehensive training, for crew 
and ground control, the advantages of testing and the 
importance of examining anomalies in detail for hidden 
concerns. Having alternate methods to perform critical 
functions has been the key to recovering from numerous 
failures, and human judgment was vital in several 
instances. Additional design margin or flexibility also 
frequently provided the means that allowed for a non- 
catastrophic result. Schedule and budgetary pressures 
that compress testing or tempt programs to sidestep 
safety precautions have repeatedly led to catastrophic or 
nearly catastrophic situations. 

Human spaceflight is complex, difficult and 
unforgiving, with so many potential avenues for things 
to go wrong. But that same human element has been the 
key to overcoming these issues time and again. And our 
ability to learn from past failures, to carry these lessons 
forward and implement protections has been the key to 
the overall success of our endeavors. 

As new countries venture out into manned spaceflight, 
as commercial companies send humans into space, they 
have the opportunity to learn from where we have 
already gone, to implement/improve the design changes 
or processes that have prevented catastrophe in the past, 
or provide for those that failed to so. 
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EVALUATING FAILURES AND NEAR MISSES IN HUMAN SPACEFLIGHT 
HISTORY FOR LESSONS FOR FUTURE HUMAN SPACEFLIGHT 


There is a wealth of information available in lessons 
learned for human spaceflight. 

- Although limited in number, human spaceflight history tends to be well- 
documented in the public forum. 

- Examining catastrophic failures for lessons learned is standard operating 
procedure. 

- Looking at n ear- miss situations where the results could have been 
catastrophic is far less common. 

- Looking at reliability in simply a binary pass/fail manner can miss these 
important subtleties that can provide excellent information for new 
programs. 

- Evaluating both catastrophic and near-catastrophic events makes the 
most of the limited number of past manned flights. 


Evaluating near miss as well as catastrophic data can add 
appreciably to the knowledge base for any manned space program. 
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Near miss failure information can provide critical data for 
new manned space programs. 

- Near miss information can provide a more complete view of credible 
failure scenarios that put human spaceflight at risk than can be gleaned 
from the small number of catastrophic events. 

- Near miss information also includes key information on what design or 
operational factors prevented catastrophe. 

• This allows a new program to ensure that comparable provisions are 
in place if the failure is pertinent. 

• This also allows new programs to leverage from the successful 
design philosophies that protected against failures. 

- This information can also add fidelity and refinement to reliability 
analyses if information on specific systems (and their failure modes) 
were factored in. 


New programs can take advantage of what failed and what worked 
and why in past spaceflight missions. 
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Launch Failure Data 

- Launch failure data, even for unmanned missions, is frequently included 
when evaluating a new manned program. 

• Launch data is extensive as there have been more 5000 launches 

- However, pass/fail criteria for unmanned flights do not always equate 
with success/failure of manned missions. 

• Some “successes” could end catastrophically for a similar manned 
mission. 

• Some “failures” might be survivable for a manned mission. 

- Data available on “ successful ” but anomalous launches is largely limited 
to manned launches. 

- For unmanned launches, anomaly data can be limited for failures; many 
of the failure analyses involve proprietary or classified information, 
limiting value. 


Launch data is useful and extensive, but has considerable 
limitations. 
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Lessons Learned from Launch Failures 

- Use of heritage hardware and/or software in a new application does not 
guarantee success 

• Integrated end-to-end testing and extensive flight testing are key to 
discovering incompatibilities prior to flight 

- Many launch failures were preceded by meaningful anomalies or failures 
in test or earlier flights that were not adequately examined or addressed. 

• Evaluation and correction for every anomalous reading during a 
successful test or failure during a test can be key to preventing 
catastrophic failure in flight. 

• This can apply not only for identical systems, but systems that use 
similar/identical components in different launch vehicles. 
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Lessons Learned From Launch “Successes” 

- Ground controller and crew knowledge of the system and awareness 
have been key factors in overcoming launch failures. 

• Training for both controllers and crew has been successful largely 
because of the combined simulations with response to an exhaustive 
amount of multi-failure scenarios. Extensive and realistic ops training 
and sims (and therefore schedule, experts and facilities) are essential 
for any new program. 

- Foreign Object Debris (FOD) has been and continues to be a serious 
hazard for launch. 

• Programs to eliminate FOD must be comprehensive and requires 
diligence. 

- Automated redundancy (not requiring human action) has also been the 
key to preventing catastrophe during launch. 


EVALUATING FAILURES AND NEAR MISSES IN HUMAN SPACEFLIGHT 
HISTORY FOR LESSONS FOR FUTURE HUMAN SPACEFLIGHT 


Crew Escape/Aborts 

- Ensure abort systems are capable of performing adequately for all 
credible situations. 

• All phases of launch/ascent are covered. 

• Allows for multiple methods to initiate abort, including from crew, 
ground control and automatically. This lesson could be expanded to 
cover most if not all emergency systems. 

- Crew escape systems have saved lives. 

- The perception of the reliability of emergency systems can affect how 
those systems are used. 

• A perception of unreliability or serious implications could delay use of 
the emergency system until its too late 

• Overconfidence in a system might restrict evaluation of other options 
that might have a higher probability of success. 
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On-Orbit Failures 

- Micrometeoroids/Orbital debris 

- Thermal control has frequently been a concern on orbit 

• Temperature extremes can adversely affect equipment as well as 
personnel. 

• Gravity driven thermal convection is not available in zero-g or vacuum 

- Attitude control/guidance issues have frequently been a concern on orbit 

• Wild gyrations can incapacitate crew. 

• Manual/automatic backup control methods can be the key to surviving 
a failure. 

- Design margin and extraneous capability can allow for unforeseen 
disaster and add flexibility. 

- Interchangeability and standardization can allow for excess capability in 
one system to support another system that’s faltering (such as the LiOH 
canisters on the Shuttle). 
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Reentry/Landing 

- Schedule pressure is frequently cited as a key driver, if not the key 
driver, in catastrophic events. 

- Loss of atmosphere is catastrophic to all manned spacecraft. Steps to 
allow for surviving these events can be key to success, such as suits 
during dynamic phases of flight or backup oxygen. 

- Corrective actions to failures of single items should be designed to be 
addressed with the constraints available, such as being crew accessible 
or correctable within the right time frame. NASA has an exhaustive 
system to evaluate this. 

- Flexibility with regards to landing locations and conditions can contribute 
to survival. 


- Designs that self-correct for potential failures can contribute to survival. 

- Human interaction has been both a solution to a catastrophic condition 
and a cause. Control designs that preclude incompatible modes can 
reduce the effects of the latter. 


Three out of four catastrophic space accidents have involved reentry. 
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Ground Safety 

- Ground safety provisions can be readily overlooked or left immature, 
preliminary and/or incomplete until late in the program. 

- Launchpad/testing fires/explosions or mislaunches that crash before 
abort is possible have cost lives on many different occasions. Launch is 
dangerous. 

• Only essential and trained personnel should be near a vehicle in a 
pre-launch condition. 

• Sating hardware before work is performed is a good practice. 

- Many have been killed or nearly killed in training exercises, in the 
spacecraft, in training craft, and in test facilities. 

- Ground personnel must be trained and cognizant of particular hazards, 
like cranes, low oxygen environment and heights. 


Rockets use flammable/explosive materials. Care should be taken at 
every step of ground processing. 
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Conclusion: 

- Evaluation of near-miss and catastrophic failures allow new programs to 
avoid past mistakes (or prepare for them so they are survivable). 

- Design factors are often readily assimilated. 

- Operations and programmatic factors may be harder to absorb. Study of 
this information can be instructive. 

- Alternate methods, additional margin, flexibility, self-correcting 
conditions, thorough testing, failure analysis, exhaustive training and 
provisions for manual interaction have all been key factors in surviving 
near-catastrophic events. 


Complexity of manned spaceflight makes it risky. A thorough 
understanding of past experiences can mitigate that risk. 
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BACKUP 


Type of 
accident 

Fatal 

Y/N? 

Date 

Program 

Incident Description 

Lessons Learned 

Source material 

CIV 

Y 

5/17/ 

1930 

Austria/ 

Early 

testing 

Max Valier was an Austrian rocketry pioneer. He 
helped found the German Verein fur 
Raumschiffahrt (VfR - "Spaceflight Society") that 
would bring together many of the minds that would 
later make spaceflight a reality in the twentieth 
century. Valier was killed when an alcohol-fuelled 
rocket exploded on his test bench in Berlin. 

Lessons learned unknown. 

1. 

httn://www.as tronautix.com/astros/valic 
r.htm 

GP 

Y 

10/10/ 

1933 

Germany/ 

Early 

rocket 

manufact. 

Three killed in explosion in rocket manufacturing 
room in Tilling, Germany 

Lessons learned unknown. 

1. 

httD://cn.wikinedia.ora/wiki/Sr)ace acci 
dents and incidents 

GP 

Y 

7/16/ 

1934 

Germany/ 

Early 

rocket 

testing 

Three killed in ground test engine explosion in 
Kummersdurf, Germany 

Lessons learned unknown. 

1. 

httn://www.as tronautix.com/lvs/v2coloa 
v.htm 

GP 

Y 

1944 

Germany/ 

Early 

rocket 

testing 

An A4-rocket crashes at a test launch in a trench. 
Several soldiers who were in the trench were killed 

Lessons learned unknown. 

1. 

httn://www.as tronautix.com/lvs/v2coloa 
v.htm 

IF 

N 

11/15/ 

1959 

US/High 

altitude 

balloon 

testing 

Drogue stabilization chute prematurely deployed, 
Kittingerentered flat spin and shrouds entangled 
around his neck. Unconscious, Jo Kittinger 
spiraled downward uncontrollably reaching 120 
rpm. Main chute deployed automatically at 12,000 
feet. Kittenger survived. Also, Kittinger was at 
risk of cardiac arrest due to his blood being 
centrifuged away from his heart. 

1 . Cannot rely on manual activiation of 
parachute systems. 

1 . Crew Survivability IAASS.pdf 1 

2. 

httD://www.nmsnacemuseum.ora/halloff 
ame/detail .nhn? id=99 

IF 

N 

8/16/ 

1960 

US/High 

altitude 

balloon 

testing 

With small stabilizing chute deployed, Kittingerfell 
for 4 minutes, 36 seconds until 28-foot main 
parachute opened at 17,500 feet and he safely 
landed after 13 minute 45 second descent 
Right glove developed leak during balloon ascent 
and hand became swollen, causing extreme pain, 
but had completely returned to normal by 3 hours 
after landing. Kittenger survived. 

1 . Isolated extremity exposure to vacuum is 
survivable (fact used in the design of some 
spacesuits). 

1 . Crew Survivability IAASS.pdf 1 

2. 

httn://www.nmst)acemuseum.ora/halloff / 
ame/detail.nhr)?id=99 /A 

http://www.spaccrcf.com/iss/oDs/OcMB 
ops.servicc.modulc.pdf /A 1 


^0 
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GP 

Y 

10/24/ 

1960 

USSR/ 

R-16 

ICBN 

As a prototype of the missile was being 
prepared for a test flight, it exploded on the 
launch pad when its second stage motors 
ignited prematurely, killing many military 
personnel, engineers, and technicians working 
on the project. (The official death toll was 90, 
but estimates are as high as 200, with 120 
being the generally accepted figure.) Despite 
the magnitude of the disaster, news of it was 
covered up for many years by the Soviet 
government and did not emerge until the 
1990s. Strategic Rocket Forces Marshal 
Mitrofan Nedelin, the commander of the R-16 
development program, was among those killed 
in the explosion and fire. 

1 . Fuel was corrosive, toxic and binary. 
Pyrotechnic membranes were 
inadvertently ruptured, forcing a safing 
procedure or accelerated launch. 

2. Rushing led to mistakes which caused 
the accident. 

3. Escape routes are essential - 
apparently many were needlessly lost, 
trapped by enclosure. 

4. Many people lost were supposed to be 
safely offsite in bunkers. Only necessary 
personnel should be exposed. 

5. Event timers alone are insufficient. 
Better to have an event timer that 
requires another status, such as pressure, 
before triggering. 

1. 

http://www.russianspaceweb.com/rl 
6 disaster.html 
2. 

http://www.aerospaceweb.ora/auesti 
on/spacecraft/aO 1 79.shtml 
3. 

http://www.astronautix.com/articles/ 

therophe.htm 

IT 

Y 

3/23/ 

1961 

USSR/ 

Trainng 

Simulat 

Bondarenko was working in a training 
simulator pressurized with pure oxygen. After 
removing some biosensors from his body 
Bondarenko washed his skin with an alcohol- 
soaked cotton ball which he dropped. The 
cotton ball landed on an electric hot plate 
which started a flash fire in the oxygen-rich 
atmosphere and ignited Bondarenko's suit. 

The watching doctor tried to open the chamber 
door but this took several minutes because of 
the pressure difference and Bondarenko 
suffered third-degree burns over most of his 
body. In 1984 the attending hospital physician 
Vladimir Golyakhovsky said that while 
attempting to start an intravenous drip he was 
only able to find an insertion point on the sole 
of one of Bondarenko's feet, where his flight 
boots had warded off the flames. According to 
Golyakhovsky, cosmonaut Yuri Gagarin spent 
several hours at the hospital as "deathwatch 
officer" and Bondarenko died of shock eight 
hours after the mishap 

1. Fires in 100% oxygen environments 
are very destructive very quickly as 
many materials are explosively 
combustible in 100% 02. Steps must be 
taken to remove (a) ignition sources, (b) 
flammables and/or reduce the percentage 
of 02. 

2. Pressure differentials for fires in 
enclosed chambers can restrict rescue. 

3. Most modern spacecraft use mixtures 
of continuously replaced oxygen and 
nitrogen and carefully test materials for 
flammability. 

4. Materials that are flame resistant in 
100% 02 may become flammable at 
pressures higher than 1 atm. This lesson 
might have prevented Apollo 1 . 

1. 

http://www.iamesobera.com/usdlO. 

html 

2. 

http://www.thespacereview.com/arti 

cle/797/1 

A 


IF 

N 

4/12/ 

1961 

USSR/ 
Vostok 1 

After retrofire, the Vostok equipment module 
unexpectedly remained attached to the reentry 
module by a bundle of wires. The two halves 
of the craft were supposed to separate ten 
seconds after retrofire, but this did not happen 
until 10 minutes had passed. The spacecraft 
went through wild gyrations before the wires 
burned through and the descent module settled 
into the proper reentry attitude. Cosmonaut 
Yuri Gagarin was unharmed and landed via 
planned ejection/parachute. 

1 . Separation is incomplete (root cause 
is not clear with data available). 

2. Very limited controls available to 
cosmonaut. 

3. Systems designed robustly can limit 
implications of failures. In this case, self- 
correcting reentry attitude by design of 
capsule and structure/hamess designed to 
be readily burned through. This failure 
has replayed many times, with no loss of 
life to date. 

1. 

httD://www.astronautix.com/fliahts/ 

vostokl.htm 

2. 

httu://ntrs.nasa. 20 v/archive/nasa/cas 
i.ntrs.nasa.aov/19630043 1 60 1 9630 
43160.odf 
3. 

httD://www.russiansnaceweb.com/v 

ostokl.html 

IF 

N 

7/21/ 

1961 

US/ 

Mercury/ 

Mercury 

4 

After Liberty Bell 7 splashed down in the 
Atlantic, the hatch malfunctioned and blew, 
filling the capsule with water and almost 
drowning Gus Grissom, who managed to 
escape before it sank. Grissom then had to 
deal with a spacesuit that was rapidly filling 
with water, but managed to get into the 
helicopter's retrieval collar and was lifted to 
safety. 

1. Faulty detonator. 

2. Water landings involve 
exposure/drowning risks; pressure suits 
can increase risk of drowning. 

1. 

httD://www.ha.nasa. 20 v/office/nao/ 

Historv/SP-4201/cover.htm 

2. 

httu://ntrs.nasa. 20 v/archive/nasa/cas 
i. ntrs.nasa. ao v/ 19630043540 19630 
43540.ndf 

3. 

httu://ntrs.nasa. 20 v/archive/nasa/cas 
i.ntrs.nasa.aov/20000025483 20000 
15159. udf 

4. 

httn://ston.isc.nasa. 20 v/collections/T 
RS/ techreD/TM -2000-209764. Ddf 

IF 

N 

8/7/ 

1961 

USSR/ 
Vostok 2 

Both cosmonauts suffered from space 
sickness. Similar reentry issue as Vostok 1 
with a failure for the service module to 
separate cleanly. Cosmonaut Titov was 
unwell but survived. 

1 . Separation is incomplete (root cause 
is not clear with data available). 

1. 

httD://www.astronautix.com/fli 2 hts/ 

vostok2.htm 

2. Aerospace Presentation non- 
US. ppt 2 


IF 

N 

2/20/ 

US/ 



1962 

Mercury/ 




Mercury 
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The "Segment 51" warning light problem was 
later determined to be a faulty sensor switch. 
The heat shield and landing bag were in fact 
secure during reentry.The Texas tracking 
station told Glenn to retain the retro pack until 
the accelerometer read 1.5 g (14.7 m/s 2 ). 

Glenn reported as he crossed Cape Canaveral 
he had been controlling the spacecraft 
manually and would use the fly-by-wire mode 
as a backup. Mercury Control then gave him 
the 0.05 g (0.49 m/s 2 ) mark, and he pressed 
the override button. After passing the peak g 
region, the Friendship 7 began oscillating 
severely. The astronaut could not control the 
ship manually. The spacecraft was oscillating 
past 10 degrees on both sides of the vertical 
zero-degree point. He activated the auxiliary 
damping system, this helped stabilize the large 
yaw and roll rates. Fuel in the automatic tanks 
was getting low. Glenn wondered if the 
spacecraft would retain stability until it was 
low enough to deploy the drogue parachute. 
The automatic fuel supply ran out at 1 minute 
and 5 1 seconds, and manual fuel ran out at 5 1 
seconds, before drogue chute deployment. The 
oscillations resumed, at 35,000 feet (10 km) 
Glenn decided to deploy the drogue chute 
manually to regain attitude stability. Just 
before he reached the switch, the drogue chute 
opened automatically at 28,000 feet (8.5 km) 
instead of the programmed 21,000 feet (6.4 
km). Retrofire calculations had not taken into 
account spacecraft weight loss due to use of 
onboard consumables. Astronaut John Glenn 
was unharmed. 
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1. Faulty indicator. 

2. Inaccurate mass calculations (did not 
account for consumables). 

1. 

Httn://ston. isc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 
2. 

http://www.hq.nasa.gov/office/pao/ 

Historv/SP-4201/cover.htm 


IF 

N 

5/24/ 

1962 

US/ 

Mercury/ 

Mercury 

7 

Partly because he had been distracted 
watching the fireflies and partly because of his 
busy schedule, and a malfunction of the 
automatic alignment system, he overshot his 
planned reentry mark, and splashed down 402 
kilometers off target. Astronaut Scott 
Carpenter was unharmed. 

1 . Pilot error. 

2. Overwork. 

3. System malfunction. 

1. 

Http://ston. isc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 
2. 

http://www.ha.nasa.aov/office/pao/ 

Historv/SP-420 1 /cover.htm 

IF 

N 

8/15/ 

1962 

USSR/ 
Vostok 4 

Life support malfunction allowed temperature 
to drop to 10 deg C and 35% humidity. 
Cosmonaut Popovich was unharmed. 

Unknown 

1. 

http://www.astronautix.com/flishts/ 

vostok4.htm 

2. Aerospace Presentation non- 
US. ppt 2 

IF 

Y 

11/1/ 

1962 

USSR/ 

High 

Altitude 

Balloon 

Exp 

Exited at 86,156 feet (28,650 m) with 
intentionally opened parachute immediately. 
Dolgov was wearing the full-pressure suit 
used for the Vostok space project. As he 
exited the balloon his helmet visor hit an 
attachment and cracked. During descent his 
suit depressurized through the cracked visor 
and he was found dead on landing. Loss of 
Pyotor Dolgov. 

1 . Inadvertent impact and 
depressurization 

2. Protecting pressurized environments 
from impact, sharp edges and protusions 
is important. 

1 . Crew Survivability IAASS.pdf 

2. 

http://www.astronautix.eom/astros/d 

olgov.htm 

IF 

N 

5/16/ 

1963 

US/ 

Mercury/ 

Mercury 

9 

On the nineteenth orbit, the first sign of 
trouble appeared when the spacecraft 0.05 g 
(0.5 m/s 2 ) light came on. The spacecraft was 
not reentering, it was a faulty indicator. On the 
20th orbit, Cooper lost all attitude readings. 
The 21st orbit saw a short-circuit occur in the 
bus bar serving the 250 volt main inverter. 

This left the automatic stabilization and 
control system without electric power. C02 
levels in the cabin and spacesuit also elevated. 
Manual entry required. Astronaut Gordon 
Cooper was unharmed. 

1. Faulty electrical system. 

2. Unclear what caused C02 elevations. 

1. 

Http://ston.isc.nasa. gov/ collections/ 

TRS/ techrep/TM-2000-209764.pdf 
2. 

http://www.hq.nasa.gov/office/pao/ 

Historv/SP-4201/cover.htm 


IF 

N 

6/14/ 

1963 

USSR/ 

Vostok5 

Spacecraft ended up in a lower than planned 
orbit and quickly decayed - temperatures in 
the service module reached very high levels 
and the flight returned early, once again the 
Vostok service module failed to separate 
cleanly from the reentry sphere. Wild 
gyrations ensued until the heat of reentry 
burned through the non-separating retraining 
strap. Cosmonaut Bykovsky survived. 

1 . Cause for the failed separation appears 
to be a restraining strap. 

1. 

httn://www. astronautix.com/fliehts/ 
vostok5.htm 

2. Aerospace Presentation non- 
US. ppt 2 

GP 

Y 

4/14/ 

1964 

US/ 

Delta 

Delta rocket ignited in assembly room, killing 
3 technicians and injuring 9 others. The 
ignition was caused by a spark of static 
electricity 

1 . Static electricity is a significant 
concern working around propellants. 

1. 

http://www.hcu 1 asa. 20 v/off 1 cc/Dao/ 
Historv/SP-421 l/chlO-5.htm 

CIV 

Y 

5/7/ 

1964 

Germany 
/ Rocket 
Demonst 
ration 

Student killed by rocket experiment by 
Gerhard Zucker 

Lessons learned unknown. 

1. 

http://www.astronautix.eom/astros/z 

ucker.htm 

GP 

Y 

7/2/ 

1964 

US/ 

NASA 

Oscar Simmons falls from the 46th floor of the 
Vehicle Assembly Building during 
construction 

Lessons learned unknown. 

1. 

http://www.ha.nasa. 20 v/office/pao/ 
Historv/SP-4204/ch 1 2 -9.html 

IT 

Y 

10/31/ 

1964 

US/ T-38 
Talon 

Theodore Freeman was killed when a goose 
smashed through the cockpit canopy of his T- 
38 Talon jet trainer. Flying shards of Plexiglas 
entered the jet engine intake and caused the 
engine to flameout. Freeman ejected from the 
stricken aircraft, but was too close to the 
ground for his parachute to open properly. 

1 . The creation of zero-zero ejection 
seats has eliminated this problem. 

2. Develop bird-strike resistant canopies. 

1. 

http://space.about.com/od/deceaseda 

stronauts/p/theodorefreeman.htm 

2. 

http://www.arlinetoncemeterv.net/tf 

reeman.htm 

3. 

http://www.thespacerace.com/peopl 

e/freeinan.Dhp 


IF 

N 

3/18/ 

1965 

USSR/ 

Voskhod 

2 

During the first spacewalk, Leonov’s Berkut 
suit ballooned, making bending difficult. 

After 12 min Leonov reentered Volga. 

Recent accounts say that he violated procedure 
by entering the airlock head first, then got 
stuck sideways when he turned to close the 
outer hatch. This forced him to flirt with 
dysbarism (the “bends”) by lowering his suit 
pressure so he could bend enough to free 
himself. Leonov recently revealed that he had 
a suicide pill he could have swallowed if he 
had been unable to ingress Voskhod 2 and 
Belyayev had been forced to leave him in 
orbit. 

Doctors reported that Leonov nearly suffered 
heatstroke - his core body temperature 
climbed 1.8 °C (3.1 °F) in 20 min - and 
Leonov stated that he was “up to his knees” in 
sweat, so that his suit sloshed when he moved. 

1 . Overheating is a significant concern 
for EVA. 

2. A pressurized spacesuit is difficult to 
maneuver in. 

3. Hatchways and other internal 
volumes and/or EVA pathways should 
allow ample room for suited 
crewmembers. 

4. Pressure drops, without suitable 
prebreathe, can lead to the bends. 

1. 

httr>://articles. gourt.com/en/Voskhod 
%202 

2. 

httn://snaceflightl. nasa.gov/snacene 
ws/factshccts/ndfs/EVACron.ndf 

3. 

httn://www.svengrahn. nn.se/histind/ 
Voskhod2/Voskhod2.htm 

4. 

Httn://ston.isc.nasa. gov/ collections/ 
TRS/ techren/TM-2000-209764.ndf 

IF 

N 

3/19/ 

USSR/ 

Voshkod 2 had a troublesome re-entry, when, 

1 . Software failure prevented the 

1. 



1965 

Voskhod 

the automatic landing system had 

automatic landing systems from 

httn://www. svengrahn.nn.se/histind/ 




2 

malfunctioned and had to use the manual 

functioning. 

Voskhod2/ Voskhod2 . htm 





system, which, for other reasons, lead to a 

2. Direct communication was limited 

2. 





2000 km overshoot. Finally, the crew landed 

(above ground stations) and hampered 

httn://articles. gourt.com/en/Voskhod 





in an inhospitable and heavily-wooded part of 

efforts to coordinate manual retro firing 

%202 





the Ural Mountains and spent a night 

3. Soyuz is equipped with a hunting gun 






surrounded by wolves while waiting for their 

in case of coming down in an 






recovery team. Although they had been 

inhospitable region. 






spotted within hours of landing, immediate 







rescue was not possible. Cosmonauts Pavel 







Belyayev and Alexey Leonov were unharmed. 



IF 

N 

6/3/ 

US/ 

Astronaut could barely get back into capsule 

1. Faulty hatch. 

1. 



1965 

Gemini/ 

after first American spacewalk because of a 

2. Computer error. 

httn://www. astronautix.com/flights/ 




Gemini 

faulty hatch. The inadvertent alteration of the 


gemini4.htm 




4 

computer memory during the 48th revolution 


2. 





in an attempt to correct an apparent 


Httn://snaceflight Lnasa.gov/snacene 





malfunction. This made the planned computer- 


ws/factshccts/ndfs/EVACron.ndf 





controlled reentry impossible and required an 


3. Aerospace Presentation US.ppt 3 





open-loop ballistic reentry. 


A 




GP 

Y 

8/3/ 

1965 

US/ 

NASA 

Lightning killed Albert J. Treib on launch pad 
B of Launch Complex 39 

1 . Lightning poses a hazard to crew and 
spacecraft. Lightning arresting systems 

1. 

http://www.hci.nasa. 20 v/officc/Dao/ 





can protect pad, people and spacecraft. 

Historv/SP-4204/ch 12-9.html 

IF 

N 

8/29/ 

1965 

US/ 

Gemini/ 

Gemini 

Gemini 5 landed 130 kilometers short of its 
planned Pacific Ocean landing point due to a 
software error. The Earth's rotation rate had 

1 . Inaccurate software values can have 
considerable effect on flight parameters. 

1. 

http://ntrs.nasa.Eov/archive/nasa/cas 
i. ntrs.nasa. ao v/ 19750067642 19750 




5 

been programmed as one revolution per solar 
day instead of the correct value, one 
revolution per sidereal day. Astronauts 


67642.pdf 

2. 

http://www.hq.nasa. 20 v/off 1 ce/pao/ 





Gordon Cooper and Pete Conrad were 
unharmed. 


Historv/SP-4203/cover.htm 

3. 

Http://ston.isc.nasa. 2 ov/collections/ 







TRS/ techrcp/TM-2000-209764.pdf 

IF 

N 

12/12/ 

1965 

US/ 

Gemini/ 

All went well right up to ignition— in fact the 
engines did ignite, but then a plug fell out of 

1 . Hardware was not reliable and not fit 
for a high vibration environment. 

1. 

http://ntrs.nasa. 20 v/archive/nasa/cas 




Gemini 

the bottom of the rocket, starting the onboard 

2. Lack of confidence in emergency 

i. ntrs.nasa. uo v/ 1979007 6749 1 9790 




6 

programmer. This was not meant to happen 
until the rocket had actually lifted off, and the 
onboard computer detected that there was no 

system can preclude its use. 

76749.pdf 

2. 

http://www.hq.nasa. 20 v/office/pao/ 





upwards motion, causing it to abort the launch. 
At this point mission rules dictated that the 
crew should eject from the spacecraft, as the 


Historv/SP-4203/cover.htm 

3. 

Http://ston.isc.nasa. 20 v/collections/ 





rocket would explode on impact with the pad 
if its trajectory was off by even an inch. 
Schirra elected not to eject as neither he nor 
Stafford had detected any upwards motion, 
and the ejection seats were seen as a last 
resort. Astronauts Wally Schirra and Thomas 
Stafford were unharmed. 


TRS/ techrcp/TM-2000-209764.pdf 

IT 

Y 

2/28/ 

1966 

US/ T- 
38 

Crash of T-38 Talon jet trainer. A NASA 
investigative panel later concluded that pilot 

1 . Pilot error. 

1. 

http://en.wikipedia. 0 r 2 /wiki/Elli 0 tt 




Talon 

error caused by poor visibility due to bad 
weather had been the principal cause of the 
accident. The panel concluded that See was 
flying too low to the ground during his 
approach, probably as a result of the poor 
visibility. Loss of astronauts Elliot See and 
Charles Bassett. 


See 

A 


IF 

N 

3/17/ 

1966 

US/ 

Gemini/ 

Gemini 

8 

During Gemini 8, a maneuvering thruster 
refused to shut down and put their capsule into 
an uncontrolled spin. Problem occurred while 
mated to an Agena. Crew thought the spin was 
Agena related and seperated, which resulted in 
the spin accelerating since the thruster had less 
mass to accelerate. The g-force became so 
intense the astronauts were possibly within 
seconds of blacking out when they regained 
control by turning off the orbital 
manuevering/attitude system and using the 
reentry system. Astronauts Neil Armstrong 
and David Scott were unharmed. 

1 . Failed on thruster cause was not 
conclusively identified. Corrective 
action included provisions to isolate 
faulty thrusters (still in use today). 

2. Original cause was misidentified and 
led to a remedy that accelerated the 
problem. Stresses how important it is to 
know one's systems. 

3. Important to be able to reach critical 
controls, even in high-g environment. 

1. 

http://www.hq.nasa.gov/officc/pao/ 

Historv/SP-4203/cover.htm 

2. 

http://www.astronautix.com/flights/ 

gemini8.htm 

3. 

Http://ston. isc.nasa.gov/collections/ 
TRS/ tcchrep/TM -2000-209764. pdf 

IF 

Y 

5/1/ 

1966 

US/ 

High 

altitude 

balloon 

testing 

During ascent at 57,600 feet ground control 
heard a sudden gush of air on radio and heard 
Piantanida'svoice, screaming "Emergency!" 
Gondola cut from balloon by ground control 
and drogue chute opened as planned. 25 
minutes later gondola landed and rescue team 
pulled out a moaning and gasping Piantanida. 
Nick Piantanida died in a hospital four months 
later. 

Lessons learned unknown. 

1 . Crew Survivability IAASS.pdf 1 

2. 

http://www.astronautix.eom/astros/d 

olgov.htm 

IF 

N 

6/5/ 

1966 

US/ 

Gemini/ 

Gemini 

9 

Astronaut's faceplate continually fogged over 
during EVA due to heavy exertion. Resulted 
in shortened EVA and difficulties while 
reentering spacecraft. 

1 . EVA involves a great deal of 
exertion. 

2. Cooling for EVA is essential. 

3. Antifogging measures for EVA are 
important. 

4.. Metabolic loading is key. Tasks must 
be planned that do not overstress 
crewmember and EVAs should be 
monitored. 

1. 

Http ://spaccflightl. nasa.gov/spacenc 
ws/factsheets/pdfs/EV ACron.pdf 
2. 

http://www.hq.nasa.gov/officc/pao/ 

Historv/SP-4203/cover.htm 

3. 

Http ://ston. isc.nasa.gov/collections/ 
TRS/ tcchrep/TM -2000-209764. pdf 


IT 

Y 

1/27/ 

US/ 



1967 

Apollo/ 




Apollo 




1 


Fire destroyed the command module (CM- 
012) during a test and training exercise at Pad 
34 (Launch Complex 34, Cape Canaveral, 
then known as Cape Kennedy) atop a Saturn 
IB rocket. The crew members were reclining 
in their horizontal couches, running through a 
checklist when a voltage transient was 
recorded at 6:30:54 (23:30:54 GMT). Ten 
seconds later, the crew reported fire. After 
nearly ten seconds of frenetic movement 
noises Chaffee yelled, "We've got a bad fire! 
Let's get out! We're burning up! We're on fire! 
Get us out of here!" Only 17 seconds after the 
first indication by crew of any fire, the 
transmission ended abruptly with a scream of 
pain at 6:31:21 as the cabin ruptured after 
rapidly expanding gases from the fire 
overpressurized the CM to 29 psi. Toxic 
smoke from the leaking command module and 
malfunctioning gas masks disrupted the 
ground crew attempting to rescue them. It took 
five minutes to open the hatch, a layered array 
of three hatches with many ratchets. Loss of 
astronauts Virgil I. "Gus" Grissom, Ed White 
and Roger B. Chaffee. 


22 


1 . Inward opening door precluded rescue 
because of pressure differential. 

2. Fires in 100% oxygen environments 
are very destructive very quickly as 
many materials are explosively 
combustible in 100% 02. Steps must be 
taken to remove (a) ignition sources, (b) 
flammables and/or reduce the percentage 
of 02. 

3. 02 pressure was actually above 
ambient pressure ~16.7 psia. 

4. Considerable flammable materials 
and materials that offgas flammable 
gases present in crew module. 

5. CM-0 12 was delivered to NASA with 
dozens of acknowledged but unresolved 
flaws. 

6. Insufficient emergency equipment 
and capabilities to provide timely rescue. 

7. Substandard wiring and plumbing in 
spacecraft. 

8. Corrective actions included: (a) 
changing air mix to 02/N2, (b) using a 
quick outward opening hatch, (c) 
replacement of flammable materials with 
self-extinguishing ones (including suits), 
(d) insulating plumbing/wiring, (e) 
correction of 1407 wiring problems, and 
(f) improved documentation of 
spacecraft construction. 


1 . 

http://www.hq. nasa.gov/office/Dao/ 
Historv/SP-4204/chl8-l.html 
2 . 

hllp://www. hq.nasa.gov/officc/pao/ 
Historv/SP-4204/ch 18-2.html 

3. http://historv.nasa.gov/SP- 
4029/Apollo Ola Sunnnarv.htm 

4. http://historv.nasa.gov/SP- 
4029/Apollo 01c Timeline.htm 

5. 

http://www.hq.nasa.gov/officc/pao/ 
History/ Apollo204/find.html 

6 . 

Http://ston, isc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 


IF 

Y 

4 / 24 / 

1967 

USSR/ 
Soyuz/ 
Soyuz 1 

However, the main parachute did not unfold 
due to a faulty pressure sensor which had not 
been detected during manufacture. Komarov 
tried to activate the manually deployed reserve 
chute, but it became tangled with the drogue 
chute, which deployed but did not release. As 
a result, it fell to Earth (in Orenburg Oblast of 
Russia) nearly unbraked, at about 40 meters 
per second (145 km/h). Large retro-rockets 

1 . The Soyuz craft had never been 
successfully flown on an unmanned 
testflight. 

2. Soyuz 1 engineers are said to have 
reported 200 design faults to party 
leaders, but their concerns "were 
overruled by political pressures for a 
series of space feats to mark the 
anniversary of Lenin's birthday." 

1. 

http://www.astronautix.eom/flights/s 

ovuzl.htm 

2. 

http://news.bbc.co.Uk/onthisdav/hi/d 
ates/stories/april/24/newsid 252300 
0/2523019. stm 
3. 

Http://ston. isc.nasa.gov/collections/ 





should have fired to further slow the descent. 
Instead, at impact, there was an explosion and 
an intense fire that surrounded the capsule. 
Loss of Cosmonaut Vladimir Komarov. 

(There were a number of other technical 
difficulties with this flight; however, these are 
the failures that led to the fatality) 

TRS/ techrep/TM -2000-209764. pdf 

IT 

Y 

10 / 5 / 

1967 

US/ 

Apollo/ 

Training 

Mechanical failure caused the controls of a T- 
38 jet trainer to stop responding. The plane 
went into an uncontrollable aileron roll while 
astronaut Clifton Williams was flying from the 
Cape to Mobile, Alabama. Williams ejected 
but he was traveling too fast and was at too 
low an altitude. Loss of Astronaut Clifton 
Williams. 

1 . Mechanical failure on aircraft. 

1. 

http://en.wikipedia.org/wild/Clifton 

Williams 


IF 


IT 


Y 


Y 


11/15/ 

1967 


us/x- 
15/ Fit 3- 
65-97 


In powered flight, an electrical disturbance 
distracted Adams and slightly degraded the 
control of the aircraft. At the conclusion of 
the wing-rocking portion of the climb, the X- 
15 had begun a slow drift in heading; 40 
seconds later, when the aircraft had reached its 
maximum altitude, it was off heading by 15 
degrees. As Adams came over the top, the 
drift briefly halted as the aircraft yawed 15 
degrees to the right. Then the drift began 
again; within 30 seconds, Adams was 
descending at right angles to the flight path. At 
230,000 feet, encountering rapidly changing 
air pressure, the X-15 entered a Mach 5 spin. 
Adams held the X-15's controls against the 
spin, using both the flight controls and the 
reaction controls. He managed to recover from 
the spin at 1 18,000 feet and went into an 
inverted Mach 4.7 dive at an angle between 40 
and 45 degrees. Due to technical problems 
with the aircraft, the X-15 began a rapid 
pitching motion of increasing severity, still in 
a dive at 160,000 feet per minute. Craft broke 
up before impact. Loss of Pilot Michael J. 
Adams. 


1 . Pilot was unaware of heading 
deviations (potential causes 
workload/vertigo). 

2. Heading data was not included in 
mission control telemetry so ground 
support was unaware of devations. 

3. Eletrical disturbance degraded control 
systems. 

4. Recommended (a) enhanced ground 
control telemetry and (b) screening for 
vertigo for pilots as corrective action. 


1 . 

http://ntrs.nasa.gov/archive/nasa/cas 

1. ntrs.nasa, gov/20000068530 20000 
75022.pdf 

2 . 

http://ntrs.nasa.gov/archive/nasa/cas 
i.ntrs.nasa. gov/ 196500 10561 19650 
10561.pdf 

3. 

http://arca5 lspccialproiccts.com/ada 
ms x-15 crash.html 

4. 

http://www.dfrc.nasa.gov/gallcrv/ph 
oto/X- 15/HTML/E -US AF-X- 
15.html 


12 / 8 / 

1967 


US/ pre- 

ISS/ 

Training 


Astronaut Robert Henry Lawrence, Jr. was 
flying backseat on the mission as the instructor 
pilot for a flight test trainee learning the steep- 
descent glide technique. The pilot flying made 
such an approach but flared too late. The front 
seat pilot of the aircraft successfully ejected 
upon ground impact and survived the accident, 
but with major injuries. By the time Lawrence 
ejected, the airplane had rolled onto one side 
and tragically, his ejection seat, with 
Lawrence still in it, described a low angle path 
and struck the ground, killing him instantly. 
Loss of Astronaut Robert Henry Lawrence, Jr. 


1 . 

2 . 


Pilot error. 
Late ejection. 


1 . 

http://www.hill.af.mil/library/factsh 

eets/factsheet.asp?id=5878 



N 


1968? 


US/ 

NASA 


Space suit technician was near instantaneous 
exposure to altitude of 120,000 feet. 

He recalled the saliva boiling off his tongue as 
he passed out, and regained consciousness as 
the chamber reached 14,000 feet. Since the 
pressure altitude was above the Armstrong 
Line, the test subject was subject to the effects 
of Ebullism. 

He suffered no neurological sequelae and was 
not hospitalized. This incident backed up the 
animal research data. 


1 . Human exposure to vacuum is 
survivable if repressurization occurs 
rapidly. 

2. Life support fittings and seals are vital 
in a vacuum environment 


1 . Crew Survivability IAASS.pdf 1 


IT 


3/27/ 

1968 


USSR/ 

Training 


During requalification training, Yuri Gagarin 
and his instructor died in a MiG- 1 5UTI on a 
routine training flight near Kirzhach. Cause 
has not conclusively been determined, but 
could include poor weather conditions, 
turbulence from another craft or an open cabin 
vent that led to oxygen deprivation and 
unconsciousness. 


1 . Nothing conclusive 


1 . 

http://www.astronautix.eom/astros/g 

agarin.htm 

2 . 

http://cn.wikincdia.org/wiki/Yuri G 
agarin 


IT 


N 


5/6/ 

1968 


US/ 

Apollo/ 

LLRV 


LLRV No. 1 went out of control and crashed 
at Ellington AFB, Texas; Neil Armstrong 
(pilot) ejected safely. Two NASA 
investigation boards had reported that loss of 
attitude control caused the May 6 accident that 
destroyed lunar landing research vehicle No. 

1, NASA announced. Helium in propellant 
tanks had been depleted earlier than normal, 
dropping pressure needed to force hydrogen 
peroxide propellant to the attitude-control lift 
rockets and thrusters. 


Lessons learned unknown. 


1 . 

http://av.rds.yahoo.com/ ylt=A0oG 
kuCHvZILXvAAEAlrCqMX; ylu= 
X3oDMTBvdmM3bGlxBHBndAN 
hdl93ZWJfcmVzdWxOBHNlYwNz 

/SIG=1 lue5kknl/EXP= 1268453 127 
/**http%3A//history.nasa.gov/alsi/L 
LRV-DFRCpdf 
2 . 

http://www.astronautix.com/craft/ap 

oollrv.htm 

3. 

http://en.wikipedia.org/wiki/LLRV 

4. 

http://www.astronautix.com/details/ 

apol7954.htm 

http://www.astronautix.com/deta_il' 
osl8032.htm 


25 




During a routine flight of lunar landing 
training vehicle (LLTV) No. 1, MSC test pilot 
Joseph S. Algranti was forced to eject from the 
craft when it became unstable and he could no 
longer control the vehicle. The LLTV crashed 
and burned. A flight readiness review at MSC 
on November 26 had found the LLTV ready 
for use in astronaut training, and 10 flight tests 
had been made before the accident. 

An investigating board headed by astronaut 
Walter M. Schirra, Jr., was set up to find the 
cause of the accident. And on January 8, 1969, 
NASA Acting Administrator Thomas O. Paine 
asked the review board that was established in 
May 1968 to restudy its findings on the May 6 
crash of lunar landing research vehicle No. 1 
(LLRV-1). 


26 


Lessons learned unknown. 


1 . 

http://av.rds.yahoo.com/ vlt=AOoG 
kuCHvZILXvAAEAlrCqMX; ylu= 
X3oDMTBvdmM3bGlxBHBndAN 
hdl93ZWJfcmVzdWxOBHNlYwNz 

eg-; 

/SIG=1 lue5kknl/EXP=1268453127 
/**http%3A//history.nasa.gov/alsi/L 
LRV-DFRC.pdf 
2 . 

http://www.astronautix.com/craft/ap 

oollrv.htm 

3. 

http://cn.wikipcdia.org/wiki/LLRV 

4. 

http://www.astronautix.com/details/ 

apol8054.htm 



The Soyuz 5's service module initially refused 
to separate, causing the spacecraft to begin 
reentry faced the wrong way. When the Soyuz 
started aerobraking in the upper reaches of the 
atmosphere, the combined spacecraft sought 
the most aerodynamically stable position - 
nose forward, with the heavy descent module 
facing directly into the air stream with only its 
light metal entry hatch at the front to protect it. 
The gaskets sealing the hatch began to burn, 
filling the air with dangerous fumes. 
Fortunately, struts between the descent and 
service modules broke off or burned through 
before the hatch failed. The descent module 
immediately righted itself with the heat shield 
forward to take the brunt of reentry. The 
parachute cables partially tangled and soft- 
landing rockets failed, resulting in a harder 
than usual impact which broke his teeth. The 
capsule had come down far short of its target 
landing site in Kazakhstan. The local 
temperature was -38 °C, and knowing that it 
would be many hours before rescue teams 
could reach him Volynov walked for several 
kilometers to reach a local peasant's house to 
keep warm. Cosmonaut Boris Volynov 
survived. 


27 


1. Failure to reliably separate service 
module from landing capsule was nearly 
fatal and resulted ina very rough landing. 


1 . 

http://astronautix.com/flights/soyuz 

5.htm 

2 . 

Http://ston. isc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 



The Apollo 10 lunar module went out of 
control for several very tense seconds when 
Cernan and Stafford mistakenly switched on 
the wrong guidance system. The spacecraft's 
computers became confused, and, as Cernan 
noted in The Last Man on the Moon, "all hell 
broke loose. Snoopy went nuts. We were 
suddenly bouncing, diving and spinning all 
over the place . . . The spacecraft radar that 
was supposed to be locking onto Charlie 
Brown had found a much larger target, the 
Moon, and was trying to fly in that direction 
instead of toward the orbiting command 
module." Finally, Stafford regained control by 
switching off the computers and flying the 
ship manually. "After analyzing the data," 
Cernan reported in his book, "experts later 
surmised that had we continued spinning for 
only two more seconds, Tom and I would have 
crashed. Things had been more than a little 
tense. Hell, I was scared to death. But we got 
back on track immediately." Astronauts 
Cernan and Stafford survived, unharmed. 


28 


1 . Crew error 

2. Flaw in method for guidance 


1 . 

http://www.answers.com/topic/gene 

-cernan 



As the landing began Armstrong reported they 
were "running long." The LM navigation and 
guidance computer reported several unusual 
"program alarms" as it guided the LM's 
descent, drawing the crew's attention from the 
scene outside as the descent continued. Inside 
NASA's Mission Control Center in Houston, 
Texas, computer engineer Jack Garman told 
guidance officer Steve Bales it was safe to 
continue the descent in spite of the alarms. 
When Armstrong returned his attention to the 
view outside it was apparent the computer was 
guiding them towards a large crater with rocks 
scattered around it. Armstrong took manual 
control of the lunar module and with Aldrin 
calling out data from the radar and computer, 
guided it to a landing at 20: 17 UTC on July 20 
with about 30 seconds of fuel left. Also, 
before leaving the surface, Aldrin accidentally 
broke the circuit breaker that armed the main 
engine for lift off from the moon. There was 
initial concern this would prevent firing the 
engine, which would strand them on the moon. 
Fortunately a felt-tip pen was sufficient to 
activate the switch. Astronauts Neil 
Armstrong and Buzz Aldrin were unharmed. 


29 


1 . Fuel gage reading was wrong because 
of slosh (baffles added to future 
missions). 

2. Radar left on distracted computer 
software and was causing errors. 

3. Suits are bulky, hard to control and 
limit visibility and congizance of nearby 
equipment. They are prone to damage 
equipment in vicinity. 


1 . 

http://ntrs.nasa.gov/archive/nasa/cas 

1, ntrs.nasa.gov/197 100 15566 19710 
15566.pdf 

2 . 

Http://ston. isc.nasa.gov/collections/ 
TRS/ techrep/TM -2000-2097 64.pdf 



The Saturn V was struck by lightning after 
launch. The CM's instruments momentarily 
went off-line and Mission Control lost the 
telemetry feeds from the spacecraft for several 
seconds. When ground control regained 
telemetry lock with the spacecraft, the feeds 
were garbled and reported incomplete and 
possibly inaccurate infonnation. A ground 
controller believed the signal Conditioning 
Equipment would have automatically gone 
off-line in response to the kind of disruption to 
the spacecraft's electrical systems that a 
lightning strike would cause and 
malfunctioned. 

The command to correct this was a relatively 
obscure one and no one immediately 
remembered how to implement it; however, 
lunar module pilot Alan Bean because of a 
training incident a year prior to launch where 
just such a failure had been simulated. With 
telemetry restored, the crew proceeded to 
parking orbit and was able to restore and 
verify the functionality of their spacecraft 
before re-igniting the S-IVB third stage for 
trans-lunar injection. Astronauts Pete Conrad, 
Richard Gordon and Alan Bean were 
unharmed. 


30 


1 . Lightning strikes are dangerous for 
launching/landing spacecraft. 

2. Simulations of unusual failures are 
good training. 


1 . 

http://ntrs.nasa.gov/archive/nasa/cas 

1. ntrs.nasa.gov/19760072997 19760 
72997.pdf 

2 . 

http://ntrs.nasa.gov/archive/nasa/cas 
i. ntrs.nasa.gov/ 19720066 106 19720 
66106.pdf 
3. 

Http:// ston.j sc.nasa. gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 


IF 


IF 


N 


N 


4/14/ 

1970 


US/ 

Apollo/ 

Apollo 

13 


Two days after the launch, the Apollo 
spacecraft was crippled by an explosion, 
caused by a fault in the oxygen tank. The 
explosion damaged the Service Module, 
resulting in a loss of oxygen and electrical 
power. The crew used the Lunar Module as a 
“lifeboat” in space. The command module 
systems remained functional, but were 
deactivated to preserve the vehicle's capability 
to reenter Earth’s atmosphere. Despite great 
hardship caused by severe constraints on 
power, cabin heat, potable water, and carbon 
diaxide removal, the crew successfully 
returned to Earth. Also, on this flight were 
excessive POGO oscillations that caused an 
early shutdown of one engine (through 
unplanned sensor misreading) and might have 
tom the second stage apart. Astonauts James 
Lovell, Jack Swigert and Fred Haise, Jr. all 
survived. 


1 . Pogo oscillations, seen previously, 
were made worse by turbopump 
cavitaitions. Anti-pogo measures were 
enacted as corrective action. 

2. Thermostat in the oxygen tank was 
not properly sized for the voltage source 
(which had changed from the original 
design). Configuration management did 
not provide for propagation of this 
change to all design teams. 

3. Piping was misaligned within tank 
because of mishandling, but used 
anyway, which caused unrecognized 
thermostat damage. This is a 
schedule/program decision lesson 
learned. Lack of viable spare may have 
driven a poor choice. 

4. Sensor limitations allowed thermostat 
failure (and wire damage) to go 
unrecognized. 

5. Damaged wiring (insulation burned 
off) caused actual explosion. 

6. Close proximity to other oxygen tank 
meant that both were lost. 

7. Lithium hydroxide canisters (for C02 
scrubbing) were not interchangeable and 
had to be "kluged" to work in the LM. 

8. Limited power had considerable 
impact, including minimal heating and 
resultant condensation, a significant 
concern. 


1 . 

http://ntrs.nasa.gov/archive/nasa/cas 

1. ntrs.nasa.gov/19930074343 19930 
74343.pdf 

2 . 

http://ntrs.nasa.gov/archive/nasa/cas 
i.ntrs.nasa.gov/19700076776 19700 
76776.pdf 
3. 

Http://ston. isc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 


6/19/ 

1970 


USSR/ 
Soyuz/ 
Soyuz 9 


Head-over-heels rotation of Soyuz to conserve 
fuel and lack of exercise resulted in terrible 
condition of astronauts on return, as their 
bodies had a hard time recovering from the 
time at zero g. The Soviets almost 
reconsidered their space station plans as a 
result. Cosmonauts Nikolayev and 
Sevastyanov survived. 


1. Lack of knowledge about the effects 
of zero g. 


1 . 

http://www.astronautix.eom/flights/s 

ovuz9.htm 

2. Aerospace Presentation non- 
US. ppt 2 


IT 


N 


1/23/ 

1971 


US/ 

Apollo/ 

Trainng 


Gene Ceman was flying a helicopter as part 
of his Lunar Module training as Backup 
Commander for Apollo 14. The helicopter 
crashed into the Banana River at Cape 
Canaveral, Florida. Ceman nearly drowned 
because he was not wearing a life vest and 
received some second-degree burns on his 
face and singed hair. According to official 
reports at the time, the crash was the result of 
mechanical failure. Later accounts, written by 
Cernan himself in an autobiography, admit he 
was flying too low and showing off for nearby 
boaters. The helicopter dipped a skid into the 
water and crashed. Gene Cernan was not 
critically injured. 


1. Pilot error. 

2. Not wearing life vest. 

3. Failure to follow established 
procedures. 


http://www.answers.com/topic/gene 

-ceman 

2. The Last Man on the Moon by 
Eugene Ceman and Donald A. 
Davis 4 


IT 


N 


1/29/ 

1971 


US/ 

Apollo/ 

LLTY 


An LLTV crashed at Ellington AFB, Texas. 
NASA test pilot Stuart Present ejected safely. 


Lessons learned unknown. 


1 . 

http://av.rds.yahoo.com/ ylt=AOoG 
kuCHvZlLXvAAEAlrCqMX: ylu= 
X3oDMTBvdmM3bGlxBHBndAN 
hdl93ZWJfcmVzdWxOBHNlYwNz 
cfc 

/SIG=1 lue5kknl/EXP= 1268453 127 
/**http%3A//history.nasa.gov/alsi/L 
LRV-DFRC.pdf 
2 . 

http://www.astronautix.com/craft/ap 

oollrv.htm 


http://cn.wikipcdia.org/wiki/LLRV 


IF 


N 


4/23/ 

1971 


USSR/ 

Soyuz/ 

Soyuz 

10 


Crew unable to enter Salyut 1 due to faulty 
hatch. Jammed hatch interfered with docking 
mechanism and prevented undocking. Able to 
undock after several attempts. During landing 
Soyuz air supply become contaminated and 
cosmonaut became unconscious. Cosmonauts 
Vladimir Shatalov, Aleksei Yeliseyev, and 
Nikolai Rukavishnikov survived unharmed. 


1 . Insufficient instrumentation 

2. Faulty hatch 
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1 . 

Http://ston.j sc.nasa. gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 


http://www.astronautix.eom/flights/s 

ovuzlQ.htm 



IF 

Y 

6 / 30 / 

1971 

USSR/ 

Solyut/ 

Soyuz 

11 

On June 30 , 1971 , the recovery team opened 
the capsule to find the crew dead. It quickly 
became apparent that they had suffocated. The 
fault was traced to a breathing ventilation 
valve, located between the orbital module and 
the descent module, that had been jolted open 
as the descent module separated from the 
service module. The two were held together 
by explosive bolts designed to fire 
sequentially, but in fact, they fired 
simultaneously while over France. The force 
of this caused the internal mechanism of the 
pressure equalization valve to loosen a seal 
that was usually discarded later, and normally 
allowed automatic adjustment of the cabin 
pressure. When the valve opened at 168 
kilometers (104 mi), the gradual loss of 
pressure was fatal within seconds. It is 
estimated that the cabin lost all its atmosphere 
in about 30 seconds. Within seconds, Patsayev 
realized the problem, and unstrapped from his 
seat to try and cover the valve inlet and shut 
off the valve, but there was insufficient time. 
Loss of Cosmonauts Georgi Dobrovolski, 
Vadislav Volkov, Victor Patsayev. 

1 . The valve was impossible to locate 
and block the leak before the air was 
lost. 

2 . Cabin atmosphere leaked out in 30 s; 
60 s required to close valve manually. 

3 . Other crew was not able to help 
because of confinement. 

4 . Ground crew was unaware of issues 
until recovery (insufficient telemetry). 

5. Corrective action: redesign Soyuz to 
allow two pressure-suited crew during 
reentry (rather than three without 
pressure suits). 

6. Other potential corrections: 
emergency air system capable of 
replacing worst case valve failure; 
backup valving with auto close; ensuring 
sufficient time to correct for all 
malfunctioning equipment. 

1 . 

httn :// nssdc . gsfc .nasa. gov/ nmc/mast 

erCatalog.do?sc=1971-053A 

2. 

http://www.astronautix.eom/flights/s 

ovuzll.htm 

3 . 

httn ://www. space, com/news/ snacehi 
storv/Salvutl Anniversary 010419. 
html 

4. http://historv.nasa.gov/SP- 
4209/ch8-2.htm 

5 . 

Httn://ston. isc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 

IF 

N 

7 / 26 / 

US/ 

One of the three main parachutes failed, 

1 . RCS fuel jet firing to deplete fuel 

1 . 



1971 

Apollo/ 

causing a hard but survivable splashdown. 

damaged parachute. 

http://www.astronautix.com/flights/ 




Apollo 

Crew astronauts Irwin, Scott and Worden 


apollol5.htm 




15 

survived. 


2. Aerospace Presentation US.ppt 3 


GP 


6/26/ 

1973 


USSR/ 

Kosmos 


According to a post-USSR source, a routine 
launch of a Cosmos 3M was planned for 1 :32 
a.m. on June 26, 1973s. The preparation, 
however, run into trouble, when due to a 
sensor malfunction, the fuel tank was 
overfilled. The personnel drained part of the 
fuel and refueled the launcher. Apparently, at 
this point, the fuel tank developed a leak and 
15 seconds before the liftoff, the launch 
sequence was automatically suspended. The 
launch was canceled and more than 40- 
member launch team tried to deactivate the 
vehicle. At 4: 18 and 4:20 a.m. two crews of 13 
people were dispatched to the launch pad. At 
4:22 a.m. a dual explosion shook the complex, 
followed by the fire. Seven people were killed 
at the spot, 13 were injured, two of those later 
died in the hospital. 


Lessons learned unknown. 


http://www.nissianspaceweb.com/co 

smos3.html 

2 . 

http://www.daviddarling.info/encvcl 

opedia/P/Plesetsk.html 

3. 

http://www.russianspaceweb.com/pl 

esetsk.html 


IF 


N 


4/5/ 

1975 


USSR/ 

Solyut/ 

Soyuz 

18a 


The Soyuz 18a mission nearly ended in 
disaster when the rocket suffered a second- 
stage separation failure during launch. This 
automatically triggered the launch abort 
system and caused an attitude error that 
caused the vehicle to be launched towards the 
Earth and triggered an emergency reentry 
sequence. Due to the downward acceleration, 
the crew experienced an acceleration of 21.3 g 
rather than the nominal 1 5 g for an abort. 
Upon landing, the vehicle rolled down a hill 
and stopped just short of a high cliff. The 
snow, the high altitude and the terrain meant 
the rescuers had great difficulty in making 
contact with the cosmonauts and it was the 
next day before they were safely air-lifted 
out.Cosmonauts Vasili Lazarev and Oleg 
Makarov survived, but Lazarev, the mission 
commander, suffered internal injuries due to 
the severe G- forces and was never able to fly 
again. 


1 . Booster might have been an older 
model that was not appropriate for this 
usage or was inappropriate integrated. 


http://spaccflight.iiasa.gov/histoiVs 

huttle- 

mir/refcrences/documcnts/mirhh- 

partl.pdf 

2 . 

Http:// ston.j sc.nasa. gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 
3. 

http://www.astronautix.eom/flights/s 

ovuzl81.htm 
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IF 


N 


7/24/ 

1975 


US/ 

USSR/ 

ASTP 


A serious problem that arose was due to the 
Apollo crew making a mistake during their 
preparations for re-entry that resulted in a very 
rough landing and the capsule filling with 
noxious fumes. The reaction control system 
was inadvertently left on during manual 
drogue deployment (automatic deployment 
had failed), producing uncombusted thruster 
propellant which was then sucked into the 
capsule relief valves as its pressure equalized 
with the outside air. Brand briefly lost 
consciousness, and Slayton reported suffering 
nausea. Crew experienced eye and lung 
problems. As a precaution, the three 
astronauts were hospitalized for two weeks in 
Honolulu, Hawaii. Astronauts Thomas 
Stafford, Vance Brand and Deke Slayton 
survived. 


1 . Faulty drogue deployment. 

2. Failure to turn off RCS system before 
manual deployment. 

3. Design that allows propellant 
products to get into crew cabin is an 
issue even after a failure. 


1 . 

http://ntrs.nasa.gov/archive/nasa/cas 

1. ntrs.nasa.gov/ 19750067869 19750 
67869.pdf 

2 . 

hllp://www. hq.nasa.gov/officc/pao/ 
History/apollo/sovuz.html 

3. 

http://www.hq.nasa.gov/office/pao/ 

Historv/apollo/apsoyhist.html 

4. 

http://www.hq. nasa.gov/officc/pao/ 
Historv/SP-4209/toc.htm 


IF 


N 


8/25/ 

1976 


USSR/ 

Salyut/ 

Soyuz 

21 


Mission cut short due to crew member illness, 
potentially psychotic, potententially from toxic 
fumes. Cosmonauts Boris Volynov and Vitali 
Zholobov unharmed but for potential illness. 


4. A system that precludes allowing a 
function if the current configuration is 
incompatible can preclude recurrence. 


1 . 

Http://ston.j sc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 
2 . 

http://www.astronautix.eom/flights/s 
ovuz2 1 .htm 


IF 


N 


10/16/ 

1976 


USSR/ 

Salyut/ 

Soyuz 

23 


The spacecraft experienced a remarkable and 
near-catastrophic return to Earth. It descended 
onto a frozen Lake Tengiz in the middle of a 
snowstorm. The parachutes quickly filled with 
water, and dragged the capsule and its crew 
beneath the surface. Numerous attempts by 
recovery teams to reach it by amphibious 
vehicle failed. Inside the capsule, the heating 
had to be turned down in order to conserve 
power. Eventually, swimmers attached a cable 
to the capsule that allowed it to be dragged 
clear of the lake by a helicopter. The recovery 
team found the crew still alive. Cosmonauts 
Vyacheslav Zudov and Valeri Rozhdestvensky 
survived. 


1 . Off nominal landings are a reality. 
Equipment and crew must be 
designed/trained to provide for off- 
nominal conditions. 


1 . 

Http:// ston.j sc.nasa. go v/co flections/ 
TRS/ techrep/TM-2000-209764.pdf 
2 . 

http://www.astronautix.eom/flights/s 

ovuz23.htm 


35 



IF 

N 

5/31/ 

1979 

USSR/ 

Salyut 

6 

Fire caused space station to fill with smoke. 
Crew almost had to evacuate. 

Lessons learned unknown. 

1. 

Http://ston.i sc.nasa.gov/collections/ 

TRS/ techren/TM-2 000-2 09 764 . Ddf 

IF 

N 

8/15/ 

1979 

USSR/ 

Salyut 

6 

During separation from Salyut, antenna on 
capsule snagged on station antenna. Required 
EVA to disconnect antenna. 

Lessons learned unknown. 

1. 

Httn://ston. isc.nasa.gov/collections/ 

TRS/ techrcn/TM-2000-209764.Ddf 

GP 

Y 

3/18/ 

1980 

USSR/ 

Vostok 

Vostok-2M rocket exploded on its launch pad 
at Plesetsk during a fueling operation, killing 
48. An investigation into a similar — but 
avoided — accident revealed that the 
substitution of lead-based for tin-based solder 
in hydrogen peroxide filters had resulted in the 
breakdown of the H202 and the resulting 
explosion. 

1 . Incompatible materials can have 
devastating results. 

1. 

httn://www. astronautix.com/craft/tse 
linad.htm 
2. 

httn://www.russiansnaceweb.com/r)l 

esetsk.html 

IF 

N 

6/3/ 

1980 

USSR/ 

Salyut/ 

Soyuz 

35 

Landing retrorockets failed. Capsule impacted 
with high velocity. Seat emergency shock 
system actuated. Crew had minor injuries. 
Cosmonauts Farkas and Kubasov survived. 

Lessons learned unknown. 

1. 

Httn://ston. isc.nasa.gov/collections/ 

TRS/ techrep/TM-2000-209764.pdf 

2. 

http://www.astronautix.eom/flights/s 

alt6ep5.htm 

GP 

Y 

3/19/ 

1981 

US/ 

Shuttle 

Cole, 50, and John Bjornstad, 51, of Titusville, 
died after inhaling pure nitrogen in a shuttle 
engine compartment after a launch pad test. 
The two Rockwell International mechanics 
were part of a five-man crew sent back to 
work after an allclear signal was sounded 
prematurely. Four other technicians were left 
unconscious. Mechanics died from anoxia 
during preparations for STS-1 . 

1 . It is essential that ground personnel 
have oxygen monitors to preclude going 
into areas low on oxygen. 

2. Purging with gases other than "air" 
can add to risk for ground personnel. 

3. Communications of when an area was 
"clear" to enter failed. 

4. Safety steps to preclude risk failed. 

5. Procedures between ground personnel 
and test directors were not in sync. 

1. http://www- 

lib.ksc.nasa.gov/lib/archives/chronol 
ogies/ 1981 CHRONO 1 .PDF 

2. http://www- 

lib.ksc.nasa.gov/lib/archivcs/chronol 
ogies/ 1981 CHR0NQ2 .PDF 


IF 

N 

4/10/ 

1981 

US/ 

Shuttle/ 

STS-1 

Launch scrubbed due to timing difference 
between primary and backup flight software. 
Significant thermal protection tile damage 
during launch (16 lost and 148 damaged) due 
to overpressurization wave created by solid 
rocket boosters. Overpressurization wave also 
pushed body flap beyond safe limits. 
Astronauts John Young and Robert Crippen 
were unharmed. 

1 . Preflight models did not encompass 
all of reality. 

2. Complex systems that have not been 
flown altogether can have unexpected 
effects and interactions. 

1. 

http://www.isc.nasa.gov/news/colu 
mbia/anomalv/STS 1 .pdf 
2. 

Http://ston.isc.nasa. gov/ collections/ 

TRS/ techrep/TM-2 000-2 09 764 . pdf 
3. 

http : //members . aol.com/W SNTW O 
YOU/STS 1MR.HTM 

IF 

N 

11/21/ 

1981 

US/ 

Shuttle/ 

STS-2 

Experienced erosion of the primary O-ring in 
the right SRM aft field joint. The erosion was 
the deepest experienced in flight in a case field 
joint, until the loss of the space shuttle 
Challenger on flight STS 5 1 -L. Planned five 
day mission cut nearly three days due to 
failure of one of three fuel cells that produce 
electricity and drinking water. Crew 
astronauts Engle and Truly were unharmed. 

1 . Deficiencies in O-ring design. 

1. 

http://www.astronautix.eom/flights/s 

ts2.htm 

2. Aerospace Presentation US.ppt 3 

GP 

N 

6/4/ 

1982 

US/ 

NASA 

In 1982 a technician was decompressed to 
greater than 74,000 feet (22,555 m), and 
remained there for 60 seconds. By the time the 
chamber was opened the victim had been 
above 63 millibar for 1 to 3 minutes. 

The patient was cyanotic, frothing and had 
bilateral pnuemothoraxand grade 4 
oticbarotrauma. He was given IV 
Decadronand recompressed to 6 ATA using 
NITROX (50% nitrogen 50% oxygen) 5 hours 
after exposure. By 24 hours after exposure he 
was awake and alert; he was extubatedat day 
5, and at 1 year follow-up had neurological 
performance superior to testing before the 
accident. 

Lessons learned unknown. 

1 . Crew Survivability IAASS.pdf 1 

2. 

http://www.astronautix.eom/astros/d 

olgov.htm 


IF 

N 

4/14/ 

1983 

US/ 

Shuttle/ 

STS-6 

First use of the lightweight SRM case. When 
the SRMs were dismantled, blowholes through 
the putty in both nozzle joints were found. The 
O-rings were affected by heat, but were not 
eroded. Impact damage led to structural 
overheating on the leading edge of both OMS 
pods. Crew Astronauts Bobko, Musgrave, 
Peterson, and Weitz were unharmed. 

1 . Deficient design of SRMs. 

2. Impact damage. 

1 . 

httr>://www.astronautix. com/ flights/ s 
ts6.htm 

2. Aerospace Presentation US.ppt 3 

IF 

N 

8/19/ 

1983 

USSR/ 

Salyut/ 

Salyut 

7 

During refuelling by Progress 17, the main 
oxidiser line of the Salyut 7 propulsion system 
ruptured. The seriousness of the malfunction 
was not immediately apparent in the West. 
However, after the malfunction, Salyut 7 had 
to rely on the main propulsion systems of 
visiting Progress freighters for maintaining 
orbital altitude. Required five EVAs to repair. 
Crewmembers were unharmed. 

Lessons learned unknown. 

1 . 

Httn://ston. isc.nasa.gov/collections/ 

TRS/ techren/TM-2000-209764.Ddf 

2. 

httr>://www.astronautix. com/ flights/ s 
alt7eo2.htm 



Shortly before the planned liftoff, fuel spilled 
around the base of the Soyuz launch vehicle 
and caught fire at T-90 seconds. Launch 
control activated the escape system but the 
control cables had already burned, and the 
crew could not activate or control the escape 
system themselves. Twenty seconds later 
ground control was finally able to activate the 
escape system by radio command, by which 
time the booster was engulfed in flames. Then 
the escape system motor fired, dragging the 
orbital module and descent module, encased 
within the upper shroud, free of the booster 
with an acceleration of 14 to 17g . Two 
seconds after the escape system activated the 
booster exploded, destroying the launch 
comple. The descent module discarded its heat 
shield, exposing the solid-fuel landing rockets, 
and deployed a fast-opening emergency 
parachute. Landing occurred about four 
kilometers from the launch pad. Cosmonauts 
Vladimir Titov and Gennady Strekalov were 
badly bruised after the high acceleration, but 
had survived. 


39 


1 . Lack of automatic launch abort or 
crew capability was a factor. 

2. Backup command capability (such as 
radio used here to launch the launch 
abort system) was a key capability for 
survival. 

1. 

Http://ston. isc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 
2. 

http://www.astronautix.eom/flights/s 

ovztl01.htm 


IF 

N 

12/8/ 

US/ 

During orbiter orientation, four hours before 

1 . Solder problem affected multiple 

1 . 



1983 

Shuttle/ 

re-entry, one of the guidance computers 

redundant computers (single failures 

Http://ston.isc.nasa.aov/collections/ 




STS-9 

crashed when the RCS thrusters were fired. A 

affecting redundant critical items should 

TRS/ techrep/TM-2000-209764.pdf 





few minutes later, a second crashed in a 

be eliminated wherever possible). 

2. 





similar fashion, but was successfully rebooted. 

2. Single hydrazine leak affected 

http://www.astronautix.eom/fliahts/s 





Young delayed the landing, letting the orbiter 

multiple APUs (single failures affecting 

ts9.htm 





drift. He later testified: Had we then activated 

redundant critical items should be 






the Backup Flight Software, loss of vehicle 
and crew would have resulted.' Post-flight 
analysis revealed the GPCs failed when the 
RCS thruster motion knocked a piece of solder 
loose and shorted out the CPU board. 
Columbia landed successfully. Right before 
landing, two of the orbiter's three auxiliary 
power units caught fire due to a hydrazine 
leak. The leak was later discovered after it 
burned itself out and caused major damage to 
the compartment. Astronauts John W. Young, 
Brewster H. Shaw, Owen K. Garriott, Robert 
A. Parker, Ulf Merbold (ESA, West 
Germany), and Byron K. Lichtenberg were 
unharmed. 

eliminated wherever possible). 


IF 

N 

2/3/ 

US/ 

Experienced O-ring erosion in both the right 

1 . Deficiencies in O-ring design. 

1 . 



1984 

Shuttle/ 

hand nozzle joint and the left SRB forward 


http://www.astronautix.eom/fiiahts/s 




STS- 

field joint. The O-ring erosion extended over 2 


ts41b.htm 




41B 

to 7 cm with a maximum depth of 1 mm. The 
concept of 'acceptable erosion' began to be 
advocated by SRM builder Thiokol and 
NASA management. Crew Astronauts Brand, 
Gibson, McCandless, McNair and Stewart 
were unharmed. 


2. Aerospace Presentation US.ppt 3 

IF 

N 

4/6/ 

US/ 

Experienced erosion of the primary O-ring in 

1 . Deficiencies in O-ring design. 

1 . 



1984 

Shuttle/ 

the right-hand nozzle joint. Crew Astronauts 


http://www.astronautix.eom/fliahts/s 




STS- 

Crippen, Hart, Nelson, Scobee, and van 


ts41c.htm 




41C 

Hoften were unharmed. 


2. Aerospace Presentation US.ppt 3 


40 


IF 

N 

10/10/ 

US/ 

In response to the American Strategic Defence 

1 . Equipment and crew can be affected 

1 . 



1984 

Shuttle/ 

Initiative and continued military use of the 

by ground-based lasers. 

httD://www.astronautix.com/fliahts/s 




STS- 

shuttle, the Soviet Union fired a 'warning shot' 


ts41g.htm 




41G 

from the Terra-3 laser complex at Sary 
Shagan. The facility tracked Challenger with a 
low power laser on 10 October 1984. This 
caused malfunctions to on-board equipment 
and discomfort / temporary blinding of the 
crew, leading to a US diplomatic protest. 

Crew was unharmed. 


2. Aerospace Presentation US.ppt 3 

IF 

N 

6 / 26 / 

US/ 

Pad abort at T-4 seconds when anomaly 

1 . Evacuation was not encouraged 

1 . 



1984 

Shuttle 

detected (potential fire) in one main engine. 

because escape system had not been 

Httr>://ston.i sc.nasa.gov/collections/ 




/STS- 

Experienced primary O-ring erosion in both 

tested. 

TRS/ techrep/TM-2000-209764.pdf 




41D 

the right-hand forward field joint and the left- 

2. Inadequate training for abort 

2. 





hand nozzle joint. There was a small amount 

scenarios. 

http://av.rds.vahoo.com/ vlt=AOoG 





of soot behind the primary O-ring, indicating 

3. Deficiencies in O-ring design. 

kt 7wZlLvW0Bl AJrCqMX; vlu=X 





short duration blow-by. This was the first 


3oDMTBvdmM3bGlxBHBndANhd 





occurrence of blow-by in either the case-to- 


193ZWJfcmVzdWxOBHNlYwNzca- 





case or nozzle-to-case joints.Crew was not 


- 





harmed. 


/SIG=13bekclle/EXP= 1268454267/ 







**http%3A//www. wvlelabs.com/co 

ntent/alobal/documents/Health%252 

0Threats%2520-%2520Clark.pdf 

3. 

http://www.astronautix.eom/fliahts/s 

ts41d.htm 

4. Aerospace Presentation US.ppt 3 

IF 

N 

4/12/ 

US/ 

The inboard right-side brake locked on 

1 . Deficiencies in O-ring design. 

1. 



1985 

Shuttle 

landing, resulting in severe brake damage and 


http://www.astronautix.eom/fliahts/s 




/STS- 

the explosion of the tire. Experienced erosion 


ts51d.htm 




51D 

of the primary O-rings in both nozzle joints. 
There was no blow-by past either nozzle O- 
ring. Severe elevon TPS damage caused 
carrier panel burth-through and structural 
damage to elevon leading edge. Damge to 
thermal barrier interfere with externall tank 


2. Aerospace Presentation US.ppt 3 





umbilical door closure during flight. Crew 
was unharmed. 


A 



41 



IF 

N 

4/29/ 

US/ 

Suffered the worst O-ring erosion experienced 

1 . Deficiencies in O-ring design. 

1 . 



1985 

Shuttle 

prior to the loss of Challenger on STS-5 1 -L. 


httn://www.astronautix.com/fliahts/s 




/STS- 

The left-hand nozzle primary O-ring eroded to 


ts51b.htm 




51B 

a depth of 4 mm inches over a 4 cm span with 
considerable blow-by. The secondary O-ring 
was eroded to a depth of 8 mm inches over an 
8 cm span. Right OMS Y-web broken carrier 
panel caused overheating and delamination of 
OMS pod substructure. Crew was unharmed. 


2. Aerospace Presentation US.ppt 3 

IF 

N 

7/29/ 

US/ 

Five minutes, 45 seconds into ascent, number 

1. Faulty sensor. 

1 . 



1985 

Shuttle 

one main engine shut down prematurely due to 

2. Deficiencies in O-ring design. 

http://scicncc.ksc.nasa. so v/shuttlc/m 




/STS- 

a faulty high temperature sensor. This was the 

issions/5 l-t/mission-5 1 -f.html 




51F 

only in-flight main engine failure of the shuttle 


2. 





program. At about the same time, a second 


Http://ston.isc.nasa. gov/collections/ 





main engine almost shut down from a similar 


TRS/ techrcp/TM-2000-209764.pdf 





problem, but this was observed and inhibited 


3. 





by a fast acting flight controller. The failed 


http://www.astronautix.eom/flights/s 





SSME resulted in an Abort To Orbit (ATO) 


ts51f.htm 





trajectory, whereby the shuttle achieves a 
lower than planned orbital altitude. Also 
experienced a blow hole through the putty in 
the right-hand SRM nozzle and the primary O- 
ring was affected by heat. The crew was 
unharmed. 


4. Aerospace Presentation US.ppt 3 

IF 

N 

10/30/ 

US/ 

Experienced erosion of the right-hand nozzle 

1 . Deficiencies in O-ring design. 

1 . 



1985 

Shuttle 

primary O-ring and the first case-to-case field 


http://www.astronautix.eom/flishts/s 




/STS- 

joint O-ring anomaly since mission STS 51-C. 


ts61a.htm 




61A 

There was blow-by past the primary O-rings in 
the centre and aft field joints on the left-hand 
SRM. The O-rings were not damaged. The 
crew was unharmed. 


2. Aerospace Presentation US.ppt 3 


IF 

N 

11/21/ 

USSR/ 

Cosmonaut Vasyutin returns to earth early due 

1 . Emergency evacuation route 

1. 



1985 

Salyut/ 

to illness (infection). Soyuz T-14 

important when medical care is minimal 

Http://ston. isc.nasa.gov/collections/ 




Soyuz 

demonstrated the wisdom of maintaining a 

on orbit. 

TRS/ techrep/TM-2000-209764.pdf 




T-14 

Soyuz at Salyut 7 as an emergency medical 


2. 





evacuation vehicle: the mission commander 


http://av.rds.vahoo.com/ vlt=AOoG 





Vasyutin fell ill which forced an early 


kt 7wZlLvW0Bl AJrCqMX; vlu=X 





termination of the planned 6 month mission. 


3oDMTBvdmM3bGlxBHBndANhd 

193ZWJfcmVzdWxOBHNlYwNzcg- 







/SIG= 1 3bekcl 1 e/EXP= 1268454267/ 







**http%3A//www. wvlelabs.com/co 
ntent/global/documents/Health%252 
0Threats%2520-%2520Clark.pdf 
3. 

http://www.astronautix.eom/flights/s 

al7eo42.htm 

IF 

N 

1/6/ 

US/ 

On a 6 January 1986 launch attempt, a 

1. Temperature probe became FOD. 

1. 



1986 

Shuttle/ 

temperature probe inside a propellant line 


http://www.astronautix.eom/flights/s 




STS- 

broke off and went into a fluid control valve in 


ts61c.htm 




61C 

one of the SSME's, jamming it in the open 
position. Had the launch not been scrubbed for 
other reasons, the valve probably would have 
caused a turbopump engine overspeed at 
engine shutdown, resulting in disintegration, 
and loss of both nearby hydraulic systems. 
Columbia would have made it to orbit, but 
been unable to return to earth. This would 
have been compound by a massive undetected 
loss of liquid oxygen propellant before the 
launch. This would have meant Columbia 
would have run out of propellant, not reached 
orbit, then lost its hydraulic systems, and then 
burned up on reentry. Crew for actual flight 
was unharmed. 




IF 

Y 

1/28/ 

1986 

US/ 

Shuttle/ 

STS- 

51L 

The Space Shuttle Challenger was destroyed 
73 seconds after lift-off on STS-51-L. 

Analysis of the accident showed that a faulty 
O-ring seal had allowed hot gases from a 
shuttle solid rocket booster (SRB) to weaken 
the external propellant tank, and also the strut 
that held the booster to the tank. The tank aft 
region failed, causing it to begin 
disintegrating. The SRB strut also failed, 
causing the SRB to rotate inward and expedite 
tank breakup. Challenger was thrown 
sideways into the Mach 1 .8 windstream 
causing it to break up in midair with the loss 
of all seven crew members aboard: Greg 
Jarvis, Christa McAuliffe, Ronald McNair, 
Ellison Onizuka, Judith Resnik, Michael J. 
Smith, and Dick Scobee. NASA investigators 
determined they may have survived the initial 
explosion but, while possibly unconscious 
from hypoxia, any survivors of the breakup 
were killed when the largely intact cockpit hit 
the water at 200 mph (320 km/h). 

1 . Design flaw, as O-ring performance 
could be too easily compromised by 
factors including the low temperature on 
the day of launch. 

2. Failure of both NASA and its 
contractor, Morton Thiokol, to respond 
adequately to the design flaw. 

3. "...failures in communication... 
resulted in a decision to launch 51-L 
based on incomplete and sometimes 
misleading information, a conflict 
between engineering data and 
management judgments, and a NASA 
management structure that permitted 
internal flight safety problems to bypass 
key Shuttle managers." 

4. Feynman argued that the estimates of 
reliability offered by NASA 
management were wildly unrealistic, 
differing as much as a thousandfold from 
the estimates of working engineers. "For 
a successful technology," he concluded, 
"reality must take precedence over 
public relations, for nature cannot be 
fooled." 

5. Excessive ice in place and lowest 
temperature launch. 

6. Corrective actions included: (a) 
redesign of SRB and (b) creation of 
SR&QA office, and (c) making efforts to 
make Shuttle schedules more realistic. 

1. 

http://science.ksc.nasa.aov/shuttle/rn 
issions/ 5 1 -1/docs/roaers- 
commission/ table-o f-contents.html 
2. 

http://historv.nasa.aov/roaersrep/v6c 

h6.htm 

3. 

http://historv.nasa.eov/kerwin.html 

4. 

http://historv.nasa.aov/roaersrep/acti 

ons.pdf 

5. 

http://www.archive.ora/details/Chall 

enaerAccidentandlnvestiaation 

6. 

http://historv.nasa.aov/sts5 1 l.html 

7. 

http://science.ksc.nasa.aov/shuttle/rn 
issions/5 1 -1/docs/cvents.txt 

8. 

Http://ston.isc.nasa.aov/collections/ 
TRS/ tcchrcp/TM -2000-209764. pdf 

IF 

N 

11/4/ 

1987 

USSR/ 
Mir 3 

Kvant module failed to dock to Mir. Crew 
performed EVA to remove foreign object from 
docking port. 

1 . Space environment can badly degrade 
materials. 

1. 

Http://ston.isc.nasa.aov/collections/ 
TRS/ techrep/TM -2000-209764. pdf 


IF 

N 

9/5/ 

1988 

USSR/ 

Mir/ 

Soyuz 

TM-5 

Soyuz TM-5 undocked from Mir. They 
jettisoned the orbital module and got ready for 
the deorbit burn. The deorbit bum did not 
occur because the infrared horizon sensor 
could not confirm proper attitude. Seven 
minutes later, the correct attitude was 
achieved. The main engine fired, but Lyakhov 
shut it down after 3 seconds to prevent a 
landing overshoot. A second firing 3 hours 
later lasted only 6 seconds. Lyakhov attempted 
to manually deorbit the craft, but the computer 
shut down the engine after 60 seconds. After 
three attempts at retrofire, the cosmonauts 
were forced to remain in orbit a further day, 
until they came into alignment with the 
targeted landing site again. The cosmonauts 
were left for a day in the cramped quarters of 
the descent module with minimal food and 
water and no sanitary facilities. Reentry 
occurred as normal on September 7, 1988. 
Cosmonauts Alexandr Lyakhov and Abdul 
Aliad Mohmand (from Afghanistan) survived. 

1 . Quick thinking and breaking protocol 
saved crew's lives as a package that 
allowed deorbit was almost 
automatically jettisoned. 

2. Critical module was subsequently 
retained until after deorbit bum to 
preclude a similar situation. 

1. 

Http://ston.isc.nasa. 20 v/collections/ 
TRS/ techrep/TM-2000-209764.pdf 
2. 

http://www.astr 0 nautix.com/fli 2 hts/ 

mireo3.htm 

3. 

http://en.wikipedia. 0 r 2 /wiki/S 0 vuz 

TM-5 

IF 

N 

12/2/ 

1988 

US/ 

Shuttle/ 

STS- 

27R 

At T+85 seconds a large piece of debris struck 
the shuttle. The orbiter took 707 hits, 298 
greater than an 2.4 cm in size. One tile was 
knocked off, but behind it was a thick plate 
covering the L-band antenna. Otherwise bum- 
through would have occurred. A leak in the 
left inboard wheel/tire assembly occurred on 
orbit of 1 .4 psig a day. The crew landed 
unharmed. 

1 . It was later found that the nose cone 
had failed during ascent due to a change 
in the manufacturing process of the 
ablative material that protected the 
SRB's during launch. 

1. 

http://www.astronautix.eom/fli 2 l 1 ts/s 

ts27.htm 

2. Aerospace Presentation US.ppt 3 

IF 

N 

7/17/ 

1990 

USSR/ 
Mir 6 

Airlock hatch failed to seal after EVA. Crew 
members transferred to backup airlock. Hatch 
was repaired during later EVA. Crew 
unharmed. 

Lessons learned unknown. 

1. 

Http://ston.isc.nasa. 20 v/collections/ 

TRS/ techrep/TM-2000-209764.pdf 
2. 

http://www.astronautix.com/fli 2 l 1 ts/ 


IF 

N 

3/24/ 

1992 

US/ 

Shuttle/ 

STS-45 

Damage to wing RCC Panel 10-right, most 
likely due to orbital debris [though that is now 
in dispute]. Because of the location of the 
damage on the top side of the RCC, burn 
through did not occur. However, similar 
damage in a different location could have 
caused failure of the RCC as occurred on STS- 
107. The crew landed unharmed. 

Lessons learned unknown. 

1. 

httD://www.astronautix.com/fliahts/s 

ts45.htm 

2. Aerospace Presentation US.ppt 3 

IF 

N 

3/22/ 

1993 

US/ 

Shuttle/ 

STS-55 

Pad abort at T-3 seconds due to incomplete 
ignition of one main engine. The problem was 
traced to a leak in the liquid oxygen preburner 
check valve. All three SSMEs were replaced 
as a precaution. Crew unharmed. 

1. Faulty valve. 

1. 

Http://ston. isc.nasa.gov/collections/ 

TRS/ techrcp/TM-2000-209764.pdf 
2. 

http://www.astronautix.eom/fliahts/s 

ts55.htm 

IT 

Y 

7/11/ 

1993 

Russia/ 

Mir 

Pilot Cosmonaut Sergei Vozovikov drowned 
during water survival training in Black Sea. 

Lessons learned unknown. 

1. 

http : //av .rds. vahoo . com/ vlt= AOoG 
kt 7wZlLvW0Bl AJrCqMX; ylu=X 
3 o D M TB vdmM 3 b G lxB H B nd AN hd 
193ZWJfcmVzdWxOBHNlYwNzca- 

/SIG=13bekcl 1 e/EXP= 1268454267/ 

**http%3A//www. wvlelabs.com/co 
ntent/alobal/documents/Health%252 
OThreat s%2 5 20-%2 5 20Clark. pdf 
2. 

http://www.spacefacts.de/bios/cosm 
onauts/enalish/vozovikov seraei.ht 
m 

IF 

N 

8/12/ 

1993 

US/ 

Shuttle/ 

STS-51 

Pad abord at T-3 seconds due to faulty fuel 
flow sensor. Crew unharmed. 

1. Faulty sensor. 

i. 

Http://ston.isc.nasa.gov/collections/ 

TRS/ techrep/TM-2 000-2 09 764 .pdf 

http://www.astronautix.eom/fliahts/s 
ts5 1 .htm 


IF 

N 

1/14/ 

1994 

Russia/ 

Mir/ 

Soyuz 

TM-17 

Soyuz bumped into Mir twice during fly 
around when thruster control momentarily 
froze. Crew unharmed. 

1 . Switch set improperly. 

1. 

Httn://ston. isc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 

2. 

http://www.astronautix.com/fliahts/ 

mireol4.htm 

IF 

N 

8/18/ 

1994 

US/ 

Shuttle/ 

STS-68 

Pad abort at T-1.9 s when all 3 engines shut 
down due to hgh temperatures in oxidizer 
turbopump. 

1. New engine turbopumps. Resolution 
unclear. 

1. 

Http://ston.isc.nasa.aov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 
2. 

http://www.astronautix.eom/fliahts/s 

ts68.htm 

IF 

N 

10/15/ 

1994 

Russia/ 
Mir 16 

Oxygen generator ignited inside space station, 
resulting in small fire. Crew unharmed. 

Lessons learned unknown. 

1. 

Http://ston.isc.nasa.aov/collections/ 
TRS/ techren/TM-2000-209764.ndf 

GP 

Y 

1/26/ 

1995 

China/ 

Long 

March 

Long March rocket veered off course after 
launch. Loss of no less than six. 

Lessons learned unknown. 

1. 

http://space.newscientist.com/article 
/dn8 1 44-timeline-chinas- 
spacefliaht-historv.html 
2. 

http://www.astronautix.com/lvs/cz2 

e.htm 

GP 

Y 

5/5/ 

1995 

Guiana 

Space 

Centre, 

French 

Guyana 

Anoxia; Luc Celle and Jean-Claude Dhainaut 
died during an inspection in the umbilical mast 
of the launchpad 

Lessons learned unknown. 

1. 

http://cn.wikipedia.ora/wiki/Space 
accidents and incidents 


IF 

N 

10/20/ 

1995 

US/ 

Shuttle/ 

STS-73 

Concerns for the radiators and orbital debris 
induced the program to fly with one of the 
payload bay doors partially closed. Several 
significant impacts including the largest 
orbital debris impact to date on the outside of 
the open payload bay door including the 
largest known orbital debris impactor to date 
(a piece of solder board). The Extended 
Duration Pallet, which carries extra supplies of 
oxygen and hydrogen, was in the payload bay 
at that location. The crew was unharmed. 

1. Micrometeoroids/orbital debris pose 
significant risk to the Space Shuttle 

1. STS-73 MMOD report 5 

2. 

http://science.ksc.nasa.eov/shuttle/rn 
issions/sts-73/mi ssion-sts-73.html 

GP 

Y 

2/14/ 

1996 

China/ 

Long 

March 

Long March rocket veered off course 2 
seconds after launch, crashing in the nearby 
village and destroying 80 houses, according to 
the official Chinese count, killing 59 people, 
but with U.S. defense intelligence officials 
estimating 200 dead. 

1 . China blamed the accident on a low- 
tech problem, the faulty soldering of a 
wire on a computer circuit board. 

1. 

http://www.astronautix.com/lvs/cz3 

b.htm 

2. 

http://eii.wikipedia.ore/wiki/SDace 
accidents and incidents 









There was a fire on board the Mir space 
station when a lithium perchlorate canister 
used to generate oxygen leaked. The fire was 
extinguished after about 90 seconds, but 
smoke did not clear for several minutes. 
Breathing devices did not work properly (or 
crewmember did not properly know how to 
use them) nor did fire extinguishers close to 
hand. Although protocol requires evacuating 
in Soyuz, the fire was between crew and one 
of their escape craft (Soyuz). Two-foot-long 
flame burned for about 14 minutes before 
contained. Crew had to wear respirators for 
several hours due to smoke and potentially 
toxic fumes in station. This was followed by 
continued problems with the oxygen, control, 
and thermal control systems, including a C02 
removal system failure.There were six crew on 
board at that time so access to a single Soyuz 
was insufficient. Cosmonauts Valery Korzun, 
Alexandr Kaleri, Vasili Tsibliyev, Aleksandr 
Lazutkin, German astronaut Reinhold Ewald 
and US astronaut Jerry Linenger survived. 
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1 . Using combustion to create oxygen 
can be risky. 

2. PPE and emergency gear must be in 
good repair and reliable. Finding the 
limitations during an emergency is not 
good planning. 

3. Crew must be properly trained in the 
use of all emergency gear. 

4. Lack of alternatives can dictate 
actions. 

5. Potentially risky ventures should not 
be taken without a viable escape route. 


1. http://history.nasa.gov/SP- 
4225/nasa4/nasa4.htm 

2 . 

http://commdocs.house.gov/committ 
ees/science/hsyl 26000. OOO/hsy 1260 
00 O.htm 

3. 

Http://ston, isc.nasa.gov/collections/ 
TRS/ techrep/TM-2000-209764.pdf 

4. 

http://www.astronautix.com/details/ 
mir5065 1 .htm 

5. 

http://www.astronautix.com/flights/ 

mireo23.htm 


IF 

N 

6/25/ 

1997 

Russia/ 

Mir 

At Mir during a re-docking test with the 
Progress-M 34 cargo freighter, the Progress 
collided with the Spektr module and solar 
arrays of the Mir space station. This damaged 
the solar arrays and the collision punctured a 
hole in Spektr module and the space station 
began depressurizing. The on-board crew of 
two Russians and one visiting NASA 
astronaut were able to close off the Spektr 
module from the rest of Mir after quickly 
cutting cables and hoses blocking hatch 
closure. Module sealed off, but 30% of station 
power lost due to damaged solar cell. Crew 
was not harmed. 

1 . Testing of a manual docking method 
to eliminate the automatic (but reliable) 
system ended in failure. 

2. Learning by attrition is very 
expensive. 

3. In order to isolate the punctured 
segment, cables and hoses had to be 
severed to close the hatch. 

4. Fortunately, this was a slow leak that 
allowed for isolation (8 minutes to close 
hatch). 

5 . Losing a segment with vital 
capabilities (like power) can be 
debilitating. 

6. Loss of a key supplier can lead to 
difficult choices. 

1. 

httn://www. ianes.com/aerosnace/civ 
il/news/isd/isd030203 3 n.shtml 
2. 

httn://commdocs. house, aov/committ 
ces/science/hsvl26000.000/hsvl260 
00 O.htm 

3. 

Httn://ston.isc.nasa. gov/ collections/ 
TRS/ tcchren/TM-2000-209764.Ddf 

4. 

httn://www. astronautix.com/lliahts/ 
mireo23.htm 

5. 

httn://www.astronautix.com/details/ 

mir50750.htm 

IF 

N 

8 / 17 / 

1997 

Russia/ 

Mir 

E023/ 

Soyuz 

TM-25 

The Soyuz landing rockets failed to fire on 
touchdown, giving one of the roughest 
landings experienced by a returning Mir crew. 
Cosmonauts Lazutkin and Tsibliyev survived 
the landing. 

Lessons learned unknown. 

1. 

httn://www. astronautix.com/fliahts/ 
mireo23.htm 

2. Aerospace Presentation non- 
US. ppt 2 

IF 

N 

11 / 3 / 

1997 

Russia/ 
Mir 24 

Kvant module out airlock hatch failed to seal 
after EVA. Inner hatch was used to seal 
station until replacement hatch could be 
brought to orbit. On orbit crew was 
unharmed. 

Lessons learned unknown. 

1. 

Httn://ston.isc.nasa.aov/collections/ 
TRS/ techreo/TM-2000-209764.Ddf 
2. 

httn://www. astronautix.com/fliahts/ 

mireo24.htm 

3. 

httn://www.astronautix.com/details/ 

mir50779.htm 


IF 

N 

7/23/ 

1999 

US/ 

Shuttle/ 

STS-93 

Five seconds after liftoff, an electrical short 
knocked out controllers for two main engines. 
The engines automatically switched to their 
backup controllers. Flad a further short shut 
down two engines, the orbiter would have 
ditched into the ocean, although the crew 
could have possibly bailed out. This wiring 
failure led to a program-wide inspection of the 
wiring in all orbiters. Concurrently a pin came 
loose inside one engine fuel injectors and 
impacted a cooling line in the engine nozzle 
inner surface, allowing a hydrogen fuel leak. 
This caused premature fuel exhaustion, but the 
vehicle safely achieved a slightly lower orbit. 
Had the failure propagated further, a risky 
transatlantic or RTLS abort would have been 
required. Astronauts Eileen Collins, Jeffrey 
Ashby, Steven Hawley, Catherine Coleman, 
Michel Tognini were unharmed. 

1 . Electrical short caused by damaged 
wiring. Entire fleet grounded while 
wiring issues (multiple) were reworked. 

2. Loose pin was corrected and extra 
effort put in place to limit FOD and it's 
potential damage. 

1 . 

http://spaceflight.nasa.gov/shuttle/ar 

chives/sts-93/ 

2. 

Httn://ston.isc. nasa.gov/collections/ 

TRS/ techreD/TM -2000-209764. Ddf 
3. 

httD://www.astronautix.com/flights/s 

ts93.htm 

GP 

Y 

10/1/ 

2001 

US/ 

Shuttle 

Crane operator Bill Brooks was killed in an 
industrial accident at Launch Complex 37 

Lessons learned unknown. 

1 . 

http://sDaceflightnow.com/ncws/n01 

10/02slc37accident/ 

2. 

http://en.wikipedia.org/wiki/Space 
accidents and incidents 

GP 

Y 

10/15/ 

2002 

Russia/ 

Soyuz- 

U 

A Soyuz-U exploded 29 seconds after launch, 
killing a soldier, Ivan Marchenko, and injuring 
8 others. Fragments of the rocket started a 
forest fire nearby, and a Block D strap-on 
booster caused damage to the launchpad 

Lessons learned unknown. 

1 . 

http://www.astronautix.com/chrono/ 

20024.htm 

2. 

http://en.wikipedia.org/wiki/Space 
accidents and incidents 



The Space Shuttle Columbia was lost as it 
reentered after a two- week mission, STS-107. 
Damage to the shuttle's thermal protection 
system (TPS) led to structural failure in the 
shuttle's left wing and, ultimately, the 
spacecraft breaking apart. Investigations after 
the tragedy revealed the damage to the 
reinforced carbon-carbon leading edge wing 
panel had resulted from a piece of insulation 
foam breaking away from the external tank 
during the launch and hitting shuttle's wing. 
Loss of Astronauts Rick D. Husband, William 
McCool, Michael P. Anderson, David M. 
Brown, Kalpana Chawla, Laurel B. Clark, and 
Ilan Ramon. 
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1 . NASA management failed to 
recognize the relevance of engineering 
concerns for safety. 

2. Model used to estimate TPS damage 
was not inappropriate use of model. 

3. Model resulted in large damage and 
was discounted; rationale based on 
flawed logic and insufficient data. 

4. NASA management took position that 
an unsafe condition had not been proven. 

5. Subsequent testing indicated that TPS 
materials were more susceptible to foam 
impact damage than previously believed. 

6. Subsequent arcjet testing indicated 
that TPS, particularly RCC, was 
considerably more susceptible to damage 
from overheating than previously 
believed. 

7. Organizational structure and 
processes were sufficiently flawed that 
compromise of safety was expected no 
matter who was in the key decision- 
making positions 

8. Safety organization not independent 
from program management. 

9. Corrective actions included (a) 
developing TPS repair options, (b) 
mandating capability for rescue flights, 
(c) increased visibility into ascent debris 
damage during launch, (d) changes to 
NASA culture (which may not be 
verifiable). 

10. Additional crew survival lessons in 
the Columbia Crew Survival 
Investigation Report 


1. http://caib.nasa.gov/ 

2 . 

http://caib.nasa.gov/events/public h 
earings/default.html 

3. 

http://www.nasa.gOv/columbia/foia/i 

ndex.html 

4. 

http://www.nasa.gov/columbia/medi 
a/index, htrnl 

5. 

http://www.nasa.gOv/news/reports/i 

ndex.html 


IF 

N 

5/4/ 

2003 

Russia/ 

ISS 

EO-6/ 

TMA-1 

During the re-entry, the first for the Soyuz 
TMA-1 model, the guidance failed and the 
capsule reverted to a rolling ballistic re-entry. 
This subjected the crew to over 8 G's during 
re-entry, as opposed to the 3 G's of a normal 
Soyuz lifting re-entry. It also resulted in a 
landing 460 km short of the target, and a delay 
of over two hours before recovery forces 
arrived at the capsule. Astronauts Bowersox 
and Pettit and Cosmonaut Budarin survived. 

1. First flight of the TMA-1 craft. 

1. 

httD://www.astronautix.com/flights/i 

sseo6.htm 

2. Aerospace Presentation non- 
US. ppt 2 

GP 

Y 

8/22/ 

2003 

Brazil/ 

BSA 

On August 22, 2003, a massive explosion 
destroyed a Brazilian Space Agency VLS-1 
(VLS-1 V03) rocket as it stood on its launch 
pad at the Alcantara Launching Center in the 
state of Maranhao in northern Brazil. Twenty- 
one people, standing on the launch pad, died 
when one of the rocket's four first stage 
motors ignited accidentally. The explosion 
caused a fire in the nearby jungle brush, and 
produced a large cloud of smoke that was 
visible for large distances. 21 personnel lost. 

1 . BSA criticized for using solid 
propellants that cannot be throttled back 
or stopped once ignited. 

1. 

httn://news.bbc.co.uk/2/hi/aniericas/ 
3175131. stm 
2. 

httn://www. snacedailv.com/news/ro 

cketscience-03zw.html 

3. 

httn://www. astronautix.com/lvs/vls 
.htm 

IF/CIV 

N 

9/29/ 

2004 

US/ 

Comme 

rcial/ 

SSI 

Asymetric thrust at high mach/ low AOA 
resulted in right roll of 190 deg/sec at 60 
seconds into rocket burn. 

Pilot Mike Melville reduced roll to 140 
deg/sec with aerodynamic control but needed 
reaction control jets to overcome roll 
Vehicle control regained just prior to apogee. 
Pilot Mike Melville unharmed. 

Lessons learned unknown. 

1 . Crew Survivability IAASS.pdf 

2. 

httn : //av .rds. vahoo . com/ vlt= AOoG 
kt 7wZlLvW0Bl AJrCqMX; ylu=X 
3 oD M TB vdmM 3 b G lxB H B nd AN hd 
193ZWJfcmVzdWxOBHNlYwNzcg- 

/SIG=13bekcl 1 c/EXP= 1268454267/ 

**http%3A//www. wvlelabs.com/co 

ntent/global/documents/Health%252 

0Threats%2520-%2520Clark.pdf 

http://en.wikipedia.org/wiki/SpaceS 

hipOne flight 16P 


CIV 

Y 

7/26/ 

2007 

US/ 

Comme 

rcial 

Explosion during a test of rocket systems by 
Scaled Composites during a nitrous oxide 
injector test. Three personnel lost with three 
more left in critical condition. 

1 . Cause has not yet been advertised. 

1 . 

http://www.guardian.co.uk/uk/2007/ 
iul/27/spaceexploration. world 
2. 

http://www.spacc.com/ncws/070727 
scaled explosion update.html 

IF 

N 

10/27/ 

2007 

USSR/ 

Soyuz/ 

Soyuz 

TMA- 

10 

Ballistic reentry instead of standard entry 
because of damage to a cable in the 
spacecraft’s control panel, which connected 
the control panel with the Soyuz descent 
equipment 

1 . Damaged cable 

1 . 

http://i-uspace.blogspot.com/2008/01 
/ sovuz-tma- 1 0-ballistic-landing- 
cause.html 
2. 

http://www.spacefacts.de/mission/en 
glish/ sovuz-tma- 1 0.htm 
3. 

http://en.wikipedia.org/wiki/Sovuz 

TMA-10 

IF 

N 

4/19/ 

2008 

USSR/ 

Soyuz/ 

Soyuz 

TMA- 

11 

Soyuz performed a ballistic reentry, a reentry 
steeper than a normal aerodynamic reentry, 
due to a malfunction and landed 475 km from 
intended landing point. The spacecraft's hatch 
and antenna suffered burn damage during the 
unusual reentry. The Russian news agency 
Interfax reported the ship may have entered 
the atmosphere hatch first. Although no 
injuries were initially reported, at least one 
crewmember is currently having some after 
effects. 

1 . Cause not yet determined. 

1 . 

http://www.spaceflightnow.com/stat 
ion/exp 1 6/080422descent.html 
http://www.ctv.ca/servlet/ArticleNe 
ws/storv/CT VNews/200804 1 9/ sovu 
z landing 080419/20080419 
3. 

http://en.wikipedia.org/wiki/Sovuz 

TMA-11 
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